CMS-10913_SupportingStatementA

Supporting Statement Part A

Medicare Part C Utilization Management Annual Data Submission and Audit Protocol Data Request

(CMS-10913; OMB 0938-New)

Background

CMS is requesting a New Collection type of approval for this new PRA submission.

Under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and implementing regulations at 42 CFR Parts 422, Medicare Advantage (MA) organizations (hereinafter referred to interchangeably as MAOs) are required to comply with all Medicare Part C program requirements. Additionally, CMS has authority under sections 1857(e)(1) and 1860D– 12(b)(3)(D) of the Social Security Act (hereinafter referred to as the “Act”) to require that MA organizations provide CMS “with such information . . . as the Secretary may find necessary and appropriate.” CMS also has authority, in section 1856(b) of the Act, to establish standards to carry out the MA program.

On April 12, 2023, CMS issued the Contract Year 2024 Policy and Technical Changes to the

Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly final rule (88 FR 22120), which, in part, finalized updates to the MA utilization management (UM) program requirements in §§ 422.101 and 422.137 that clarified coverage criteria for basic benefits and the annual review of UM tools. Pursuant to CMS’s authorities under Section 1857(d) of the Act to oversee MA organizations’ compliance with MA program requirements and our authority at § 422.516(a) to collect MA program information, CMS developed this data collection package to ensure that we evaluate MAOs’ compliance with §§ 422.101 and 422.137 and solicited comment on the collection in the Federal Register (89 FR 73420) on September 10, 2024 for the 60-day public comment period. Based on comments received during the 60-day public comment period, we modified elements of the data collection package to streamline the collection, and removed duplicative data requests across collection documents, to better align the estimated burden with our projections outlined in Section 12 of this Supporting Statement. Additionally, we clarified the data collection scope, process, and terminology for the purposes of the collection, and confirmed our intention to implement this data collection starting in January 2026.

In response to commenters who requested examples of how to populate the Annual Data Submission and UM Audit Protocol and Data Request Record Layouts, we have added two reference documents to the collection. We have also combined two documents (the “Standardized Formatting of Internal Criteria” and the “Instructions for Populating the Analysis of Internal Coverage Criteria”) into a single document. Lastly, we had inadvertently left out the template for the Root Cause Analysis document which is discussed in the UM Audit Protocol and Data Request. These edits collectively increase the collection from six to eight documents without further impact to burden. Also, we note that the revised 30-day comment package has retitled the “Standardized Formatting of Internal Criteria” document to “Analysis of Internal Coverage Criteria”.

For the 30-day public comment period, we continue to propose two distinct data collections included in this PRA package: (1) the annual submission of MAOs’ UM data and (2) the UM audit protocol data request.

Annual Submission: All MAOs offering the Medicare Part C benefit will be subject to the UM annual data submission. Related data collection instruments:

• Medicare Part C Utilization Management Annual Data Submission

• Utilization Management Annual Submission (UMAS) Record Layout with Examples

(optional)

UM Audits: Each year, CMS will select a subset of MAOs at the parent organization (as defined in 42 CFR 422.2) level and conduct an audit of the MAOs’ UM policies and tools using the following data collection instruments:

• CMS List of Targeted Services

• Medicare Part C Utilization Management Audit Protocol Data Request

• Utilization Management Criteria (UMC) Record Layout with Examples (optional)

• Analysis of Internal Coverage Criteria

• Medicare Part C UM Supplemental Questions

• Medicare Part C UM Root Cause Analysis

For the above data collection, we particularly solicit input on whether we should publish the Annual Submission data as a way of assisting organizations, providers and beneficiaries with finding and navigating to internal coverage criteria policies.

A. Justification

1. Need and Legal Basis

Section 1857(d) of the Act, added by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and implementing regulations at 42 CFR § 422.503 and § 422.504 state that CMS must oversee an MA organization’s continued compliance with the requirements for a MA organization. Additionally, per § 422.516(a), MA organizations are required to compile and report to CMS information related to the utilization of services, and other matters as CMS may require.

Per the Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All Inclusive Care for the Elderly final rule (88 FR 22120), MAOs must comply with new requirements pertaining to the development, appropriateness, and public accessibility of internal coverage criteria.

The data collected by way of the Medicare Part C UM annual data submission and audit protocol data request included in this PRA package will allow CMS to conduct a comprehensive review of MAOs’ compliance within UM requirements. Specifically, CMS will use the data collected to test MAOs’ compliance with the following federal requirements:

• Requirements relating to basic benefits- § 422.101

• Medicare Advantage Utilization Management Committee- § 422.137

2. Information Users

The information gathered during this annual data collection and audit will be used by the Medicare Parts C and D Oversight and Enforcement Group (MOEG) within the Center for Medicare (CM) to assess MAOs’ compliance with Medicare Part C UM requirements. CMS will utilize the data collected in response to Medicare Part C Utilization Management Annual Data Submission to help select MAOs for UM audits, to develop a national landscape of services to assess trends related to the development and utilization of internal coverage criteria, and to audit coverage criteria of selected MAOs. MAO Annual data submissions for all MAOs will be due to CMS by January 31 of each calendar year. The first UM annual data submission will be due on January 31, 2026.

Beginning on January 1, 2026, MAOs selected for a UM audit will submit additional data to CMS, including a universe of Utilization Management Criteria for the services identified in CMS’s List of Targeted Services. Once CMS validates the completeness and accuracy of the MAO’s submission, auditors will use the collected information and follow the instructions outlined in the protocol to evaluate the MAOs’ compliance with UM coverage criteria requirements, including the appropriateness and public availability of the MAO’s internal coverage criteria.

If outliers or other data anomalies are detected, MOEG requires audited organizations to provide impact analyses to better understand and report the scope of the noncompliance. When MAOs receive their audit results, they are required to implement corrective actions.

3. Use of Information Technology

The annual data submission and audit processes are 100 percent electronic and do not require respondent signatures. MAOs are able to produce approximately 75 percent of requested information from their internal systems. CMS is able to obtain the remaining 15 percent via our internal systems or public websites. The remaining 10 percent of data is manually entered by the MAOs in response to questionnaires or other audit requests.

Information collected from the MAOs for use in the audit is obtained electronically via the Health Plan Management System (HPMS), a system that was developed and is maintained by CMS, and to which all MAOs have access. This system is also secure, requiring users to request and gain access via CMS personnel and then they must create and maintain a secure user id and password.

Our annual data submission and audits are conducted remotely using secure webinar technology, as needed. This saves CMS and MAOs time, money, and other resources needed to complete the annual data submission and audit.

4. Duplication of Efforts

This information collection does not duplicate any other effort, and the information cannot be obtained from any other source.

5. Small Businesses

This collection will have a minimal impact on small businesses since applicants must possess an insurance license and be able to accept substantial financial risk. Generally, state statutory licensure requirements effectively preclude small businesses from being licensed to bear risk needed to serve Medicare beneficiaries.

6. Less Frequent Collection

42 CFR Part 422 Subpart K stipulates that CMS must oversee a MAO’s continued compliance with CMS requirements. In general, we estimate 40 UM audits per year and that audit frequency for any specific MAO will vary depending on identified compliance issues, audit referrals, a spike in the size of an MAO, and the amount of time since the MAO’s last UM audit. In addition, all MAOs that offer the Medicare Part C benefit are expected to complete the Part C Utilization Management Annual Data Submission.

Less frequent collection of the data from MAOs would severely limit CMS’ ability to perform accurate and timely oversight, monitoring, compliance, and auditing activities around Medicare Parts C UM and could result in an increased potential for harm to Medicare beneficiaries. Additionally, MAOs are allowed to update internal coverage criteria as needed throughout the calendar year, and requesting an annual submission of the criteria is necessary to maintain current and reliable information regarding the Part C benefit.

7. Special Circumstances

42 CFR § 422.504(d) stipulates that records are to be maintained for 10 years. CMS will require clarification around, or validation of, submitted audit data and, therefore needs to contact MAOs within 30 days of data submission. However, in general, and as outlined in the audit protocol, the supplemental questions document must be submitted within 5 business days of receipt of the audit engagement letter, and the audit universe must be populated and submitted to CMS within 15 business days of the audit engagement letter. MAOs are also required to submit supporting documentation within 10 to 15 business days of CMS request and provide responses to CMS requests for root cause analyses within two business days and impact analyses within 10 business days of a request during and after program audit fieldwork. While these submissions are required in fewer than 30 days of receipt of the individual notices, these timeframes are necessary to complete the entire audit process timely. Compliance issues identified following the annual data submission could also require immediate action, thus providing an MAO less than 30 days to respond to re-submission requests. Otherwise, there are no special circumstances that would require an information collection to be conducted in a manner that requires respondents to:

• Report information to the agency more often than quarterly;

• Prepare a written response to a collection of information in fewer than 30 days after receipt of it;

• Submit more than an original and two copies of any document;

• Collect data in connection with a statistical survey that is not designed to produce valid and reliable results that can be generalized to the universe of study;

• Use a statistical data classification that has not been reviewed and approved by

• OMB;

• Include a pledge of confidentiality that is not supported by authority established in statute or regulation that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or

• Submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law.

8. Federal Register

The 60-day notice for this data collection published in the Federal Register on September 10, 2024 (89 FR 73420). We received 51 unique commenters following the 60-day public comment period. Changes made to the data collection based on these comments are listed in the attached Crosswalk of Changes, along with the proposed data collection instruments for the 30-day public comment period.

This data collection can be updated with specific dates when the publication dates are known.

The 30-day notice for this data collection published in the Federal Register on December 23, 2024 (89 FR 104547).

9. Payments/Gifts to Respondents

There are no payments or gifts to respondents associated with this information collection request. MA organizations are required to comply with CMS oversight (produce records for examination, etc.) and CMS could terminate a contract for failure to comply.

10. Confidentiality

CMS will adhere to all statutes, regulations, and agency policies regarding privacy. Privacy will be maintained to the extent provided by the law. While MAOs are required to provide CMS access to records, data and other beneficiary information, CMS will ensure that the collected information and any sensitive or personal information will be transferred and/or stored through HPMS, which is a secure site.

11. Sensitive Questions

There are no sensitive questions associated with this collection. Specifically, the collection does not solicit questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

12. Burden Estimates (Hours & Wages) Wage Estimates

To derive cost estimates, we used the U.S. Bureau of Labor Statistics’ most recent

National Occupational Employment and Wage Estimates for all salary estimates

(https://www.bls.gov/oes/current/oes_nat.htm) from May 2023. In this regard, the following table presents the median hourly wage, the cost of fringe benefits (calculated at 100 percent of salary), and the adjusted hourly wage. We selected the following personnel for our burden estimate based on our previous experiences conducting Part C and Part D program audits, and staffing needs consistent with the Medicare Part C UM annual data submission and audit protocol data collection and processes.

National Occupational Median Hourly Wage and Adjusted Hourly Wage

Occupation Title	Occupation Code	Median Hourly Wage ($/hr.)	Fringe Benefit ($/hr.)	Adjusted Hourly Wage ($/hr.)
General and Operations Managers Medical and Health Services Manager (Program Director)	11-9111	53.21	53.21	106.42
Compliance Officer	13-1041	36.38	36.38	72.76
Management Analysts	13-1111	47.80	47.80	95.60
Business Operations Specialists, All Other (Quality Assurance Specialist)	13-1199	38.26	38.26	76.52
Computer Systems Analyst	15-1211	49.90	49.90	99.80
Physicians, All Other	29-1229	113.46	113.46	226.92
Lead Claims Analyst	13-1031	36.08	36.08	72.16

As indicated, we are adjusting our employee hourly wage estimates by a factor of 100 percent. This is necessarily a rough adjustment, both because fringe benefits and overhead costs vary significantly from employer to employer, and because methods of estimating these costs vary widely from study to study. Nonetheless, there is no practical alternative, and we believe that doubling the hourly wage to estimate total cost is a reasonably accurate estimation method.

Due to the differences in burden, we have created separate estimates for the annual data submission and the UM audit data request.

Wage Estimates for Medicare Part C UM Annual Data Submission

We estimated wages for the Part C UM annual data submissions by determining the median hourly wage for the positions we believe would be associated with the submission of annual data.

Occupation Title	Total Number of Positions	Adjusted Hourly Wage ($/hr.)
Computer Systems Analyst	2	100
Compliance Officer	1	73

Based on the above adjusted hourly wage rates (rounded to the nearest whole dollar) and positions, we estimate a median hourly wage of $100/hr. for MAOs’ activities related to the Medicare Part C UM Annual Data Submission.

Wage Estimates for Medicare Part C UM Audits

Based on the table above, we also selected individuals we believe would be involved in UM audits and determined the median hourly wage for a MAO to conduct a UM audit.

Occupation Title	Total Number of Positions	Adjusted Hourly Wage ($/hr.)
Program Director	1	106
Compliance Officer	1	73
Management Analyst	2	96
Quality Assurance Specialist	6	77
Computer Systems Analyst	2	100
Physician	1	227
Claims Analyst	2	72

Based on the above adjusted hourly wages (rounded to the nearest whole dollar) and positions, we estimate a median hourly wage of $77/hr. for MAOs’ activities related to the Medicare Part C UM audits.

Burden Estimates

Medicare Part C UM Annual Data Submission

We estimate that a total of 179 MAOs will incur burden associated with the UM annual data submission. This number represents the number of currently active MAOs that offer the Part C benefit. We considered multiple factors, including the hours estimated in the recent “Service Level Data Collection for Initial Determinations and Appeals” package (CMS-10905), our experience collecting universes for Part C and D program audits, and our experience reviewing internal coverage criteria on MAOs’ websites. The scope of this data varies greatly from MAO to MAO. Some MAOs have identified no internal coverage criteria, while others develop internal coverage criteria that differs from contract or contract, or locality to locality. Given these variances, our average hour estimation represents the level of effort we expect for the most sponsors, but we expect some variation that cannot otherwise be predicted. For this effort, we estimate an average of 20 hours for administrative and systemic work to assemble and submit the requested information.

Medicare Part C UM Audits

Based on our audit strategy, UM audits follow an annual cycle and involve reviewing a subset of MAOs throughout the year each year. For each MAO, we estimate an average of 150 hours for administrative and systemic work to assemble the universe information and review it for completeness, 100 hours to assemble the information required for the selected criteria, 120 hours for the actual administration of the audit, and 20 hours to review and respond to the draft audit report. The total burden equals 390 hours. We estimate the annual number of MAOs that will undergo a UM audit to be approximately 40.

Burden Summary

Information Collection	Responde nts	Responses (per Responde nt)	Total Respon ses	Burden per Respon se (hours)	Total Annual Burden (hours)	Labor Cost of Reporting ($/hr)	Total Cost
Medicare Part C UM Annual Data Submission	179	1	179	20	3,580	$100	$358,000

Information Collection	Responden ts	Response s (per Responde nt)	Total Responses	Burden per Respons e (hours)	Total Annual Burden (hours)	Labor Cost of Reporting ($/hr)	Total Cost
Medicare Part C UM Audits	40	1	40	390	15,600	$77	$1,201,200

Total Annual Costs ($)
Medicare Part C UM Annual Data Submission	358,000
Medicare Part C UM Audits	1,201,200
Total	1,559,200

13. Capital Costs

There is no capital cost associated with this collection.

14. Cost to Federal Government

The costs to the federal government include developing a system for collecting information within HPMS, staff time to participate in the audit, funding contract support for audits and the data submission that will be staff extenders during audits, but that also perform a host of other audit and enforcement activities outside of activities related to this collection effort.

Medicare Part C UM Annual Data Submission Cost

The estimated annual cost includes the development and maintenance of a module within HPMS that we would need to accommodate and the systems technology we will use. We derived this estimate based on the Medicare Part C Reporting Requirements and the information published in the recent “Service Level Data Collection for Initial Determinations and Appeals” (CMS-10905), which will also be utilizing HPMS for data collection. As with the “Service Level Data Collection for Initial Determinations and Appeals” data collection, we consider the $300,000 estimated annual cost for the Medicare Part C Reporting Requirements that supports reporting through HPMS as our baseline. This amount is the same as previously reported and is a “standard” estimate used in our ICRs when the HPMS resources support the CMS information processing and reporting role. In total, we estimate an annual cost of $500,000, which is an increase over the baseline estimate due to the volume of data we would need to accommodate and the systems technology we will use for reporting purposes.

Medicare Part C UM Audit Cost

Federal Government Staff Time*

We estimated the cost for the federal government to conduct the Medicare Part C UM audits starting with the personnel and hourly wage table below. We selected the following personnel for our burden estimate based on CMS’s previous experiences conducting Part C and Part D program audits but tailored to staffing needs consistent with the Medicare Part C UM audit protocol data collection processes.

Occupational Title	Federal Salary Scale*	Hourly Wage ($/hr)	Fringe Benefit ($/hr)	Adjusted Hourly Wage ($/hr)
CMS Auditor	GS-13/ Step 1	56.52	56.42	113.04
CMS Technical Advisor	GS-14/ Step 1	66.79	66.79	133.58

*The hourly wage estimate is based on OPM’s 2024 General Schedule (GS) Locality Pay Table for DC-MD-VA-WV-PA (https://www.opm.gov/policy-data-oversight/payleave/salarieswages/salary-tables/pdf/2024/DCB_h.pdf)

We expect the federal government to staff 40 annual UM audits under current regulations and estimate the median hourly wage for federal government staff to conduct and oversee audit activities based on the above wage table and number of staff positions indicated below.

UM Audit Activities

Occupation Title	Total Number of Positions ($/hr.)	Adjusted Hourly Wage ($/hr.)
CMS Auditor	4	113
CMS Technical Advisor	1	134

Based on the above hourly wage (rounded to the nearest whole dollar) and number of positions, we estimate a median hourly wage of $113/hr. for the federal government to conduct UM audit activities, including audit oversight.

For each of the 40 UM audits staffed by the federal government, we estimate that staff will take 200 hours to review submitted information and prepare for the audit, 120 hours for the actual administration of the audit, and 60 hours to analyze the data, issue reports, and respond to MAOs. The total burden equals 380 hours per UM audit. Therefore, the total annual hours for the federal government to conduct all 40 UM audits is 15,200 hours (40 UM audits x 380 staff hours per audit).

Total Cost for Medicare Part C UM Audits Conducted by the Federal Government

The following table summarizes the per audit cost to the federal government.

Federal Government Staff	Adjusted Hourly Wage ($/hr)	Hours Per Audit	Total Cost Per Audit ($)
5 Audit Staff	113	380	42,940

The cost per UM audit is $42,940 for all federal government audit activities. The total cost for the 40 annual UM audits conducted by the federal government is $1,717,600 (40 UM audits per year x $42,940 cost per UM audit).

Total Medicare Part C UM Annual Data Submission and Audit Cost to the Federal Government

Based on the preceding methodology, we estimate the total cost of the federal government as follows:

Total Annual Data Submission Cost $ 500,000

Total Audit Cost $1,717,600

Total Cost $2,217,600

15. Changes to Burden

This is a new collection of information request. Therefore, all burden noted in Sections 12 through 14 represent the initial burden estimates of this collection. As described above, the total hourly burden for MAOs is 3,580 hours for the Medicare Part C UM annual data submission and 15,600 hours for Medicare Part C UM audits with a total burden of 19,180 hours for both data collections.

We made no changes to data collection burden estimates based on the 60-day public comments received. Multiple commenters considered the collection burdensome and expressed concern that CMS may have underestimated the collection burden. However, in response to these comments, we made significant revisions to the data collection to better align burden with our original projected estimates in Section 12 of this Supporting Statement. For example, we eliminated data that commenters considered particularly burdensome, like CPT and HCPCS codes, removed a couple audit compliance standards, introduced timeframe limits to the Impact Analysis data collection period, removed duplicative data requests across documents to streamline the collection, and added more fields that CMS, not the MAO, will populate to better facilitate the audit process.

Overall, we believe our burden reducing changes to the data collection are more numerous and impactful than the few changes that may slightly increase burden. The attached Crosswalk of Changes further details the data collection changes for which we anticipate burden changes. Considering the changes we made to reduce the burden of the data collection in response to 60day public comments, we believe that the burden estimate proposed for the 60-day public comment period is an accurate representation of the data collection burden for the 30-day public comment period data collection. Therefore, we determined that the burden estimate for this 30-day public comment period data collection would not change.

16. Publication/Tabulation Dates

The information collected during audits and the annual data submission may be compiled in a given year and CMS may include aggregate level results in an annual audit report. If CMS aggregates information during a given year, we anticipate the information will be reported by the close of the subsequent year and the information will be posted to the CMS Parts C and D Audit website at https://www.cms.gov/medicare/audits-compliance/part-c-d.

17. Expiration Date

The expiration date will be displayed on all of the documents associated with this information, including the following documents:

• Medicare Part C Utilization Management Annual Data Submission

• Utilization Management Annual Submission (UMAS) Record Layout with Examples

• Medicare Part C Utilization Management Audit Protocol Data Request

• Utilization Management Criteria (UMC) Record Layout with Examples

• Analysis of Internal Coverage Criteria

• CMS List of Targeted Services

• Medicare Part C Utilization Management Supplemental Questions

• Medicare Part C UM Root Cause Analysis

18. Certification Statement

There are no exceptions.

B. Collections of Information Employing Statistical Methods

No statistical methods are applied to any of the audit information collected.

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is OMB 0938-New. This information collection will allow CMS to conduct a comprehensive review of Sponsoring organizations’ compliance with Medicare Part C utilization management (UM) requirements. The time required to complete this information collection is estimated at 410 hours per response, including the time to review instructions, search existing data resources, gather the data needed, to review and complete the information collection. This information collection is mandatory per CMS’s authority under Section 1857(d) of the Social Security Act and implementing regulations at 42 CFR § 422.503 and § 422.504, which state that CMS must oversee a Medicare Advantage (MA) organization’s continued compliance with the requirements for a MA organization. Additionally, per § 422.516(a), MA organizations are required to compile and report to CMS information related to the utilization of services, and other matters as CMS may require. If you have comments concerning the accuracy of the time estimate or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850.

13

11