News & Insights

Client Alert

April 10, 2023

New Medicare Advantage Regulations Add Provider and Beneficiary Protections Against Plan Utilization Management Policies

On April 5, 2023, the Centers for Medicare & Medicaid Services (CMS) issued a Final Rule (CMS-4201-F) regarding the Medicare Advantage (MA) and Part D programs. The Final Rule includes changes related to various aspects of those programs, including utilization management (UM) programs, Star Ratings, marketing and communications, health equity, provider directories, and network adequacy.

This Client Alert focuses on the changes to the regulation of MA plan UM programs. Based on stakeholder feedback and Department of Health and Human Services Office of Inspector General (OIG) findings, CMS is adding new requirements and codifying preexisting policy designed to ensure timely and appropriate access to medically necessary care for Medicare beneficiaries enrolled in MA plans. The UM program changes will (i) establish stricter requirements for MA plan medical necessity determinations, including prior authorization; (ii) impose more rigor and transparency regarding the establishment of coverage criteria; and (iii) require more uniform and centralized MA plan oversight of UM programs.

The Final Rule’s new UM program requirements are applicable to coverage beginning on January 1, 2024. The Final Rule will be published in the Federal Register on April 12, 2023.

Coverage Requirements for Basic Benefits

In the preamble to the Final Rule, CMS stated its longstanding policy is that MA plans must make medical necessity determinations based on coverage criteria that are no more restrictive than coverage under traditional Medicare Parts A and B. CMS’s policy is based on the statutory requirement that MA plans cover items and services for which benefits are available under traditional Medicare, referred to as “basic benefits.”

To implement this policy and statutory mandate, MA plans currently are required to cover basic benefits in a manner that complies with coverage criteria stated in (i) CMS National Coverage Determinations (NCDs); (ii) applicable Medicare contractor Local Coverage Determinations (LCDs); and (iii) “[g]eneral coverage guidelines included in original Medicare manuals and instructions unless superseded by regulations in [42 C.F.R. part 422] or related instructions.” 42 C.F.R. § 422.101(b)(2) (current version). The Final Rule replaces the reference to Medicare manuals and instructions with a requirement that MA organizations comply with “[g]eneral coverage and benefit conditions included in Traditional Medicare laws, unless superseded by laws applicable to MA plans.” 42 C.F.R. § 422.101(b)(2) (Final Rule). CMS states in the Final Rule preamble that removal of the requirement to comply with sub-regulatory guidance is not intended to diminish the content and value of the manuals and instructions but to conform the scope of basic benefits to the same statutes and regulations that apply to traditional Medicare.

Medical Necessity Coverage Criteria and Determinations

To ensure that basic benefits are covered under MA plans to the same extent as under traditional Medicare, the Final Rule amends the MA regulations to clarify, according to CMS, that when an item or service has “fully established coverage criteria” under an NCD, LCD, or traditional Medicare laws (Traditional Medicare Coverage Requirements), an MA plan cannot impose any additional or different coverage criteria, processes or steps based on internal, proprietary, or external clinical criteria not contained in the Traditional Medicare Coverage Requirements. For example, when coverage criteria are fully established, an MA plan may not impose “step” requirements, meaning that another item or service be furnished prior to receiving the requested item or service (with the exception of step therapy for Part B drugs). See 42 C.F.R. § 422.101(b).

Coverage criteria are considered not “fully established” when: (i) additional, unspecified criteria are needed to interpret or supplement general provisions in order to determine medical necessity consistently; (ii) NCDs or LCDs include flexibility that explicitly allows for coverage in circumstances beyond the specific indications that are listed in an NCD or LCD; or (iii) there is an absence of any applicable Medicare statutes, regulations, NCDs or LCDs setting forth coverage criteria. Accordingly, MA plans may not develop and rely on internal coverage criteria to make medical necessity decisions unless one of those three circumstances is present. 42 C.F.R. § 422.101(b)(6).  

Under the Final Rule, when coverage criteria are not fully established, MA plans may create internal coverage criteria, provided that they are based on current evidence in widely used treatment guidelines or clinical literature made publicly available to CMS, enrollees, and providers. When an MA plan uses internal coverage criteria, it must make an explanation of the coverage criteria publicly accessible and include in the explanation an identification of the general provisions that are being supplemented or interpreted and how the additional criteria provide clinical benefits that are “highly likely” to outweigh any clinical harms, including from delayed or decreased access to items or services. Id. Clinical criteria that impose sequential step requirements are not based on current evidence if the evidence does not cite or discuss the use of a different item or service before use of the requested item or services. Also, evidence that is derived solely from internal analyses from within the MA organization would not represent proper justification for instituting internal coverage guidelines that restrict access to care.

The Final Rule also amends the MA regulations to specifically require that medical necessity determinations be based on all of the following: (i) Traditional Medicare Coverage Criteria; (ii) the new requirements that apply depending on whether coverage criteria are fully established; (iii) whether the provision of items or services is reasonable and necessary; (iv) the enrollee’s medical history (for example, diagnoses, conditions, functional status), physician recommendations, and clinical notes; and (v) involvement of the MA organization’s medical director where appropriate. 42 C.F.R. § 422.101(c)(i).

Commercial Medical Necessity Tools

In its preamble discussion, CMS took a dim view of MA plans’ use of commercial coverage tools, referring specifically to InterQual and MCG systems. In particular, according to CMS, MA plans may not use such products to change coverage or payment criteria already established under Traditional Medicare Coverage Requirements, nor could such commercial tools be used if medical necessity determinations are based on an algorithm or software that does not account for an individual’s particular circumstances. In addition, CMS stated that the proprietary nature of these types of products does not absolve an MA plan from its responsibilities under the Final Rule, including public accessibility requirements. For an MA plan to use the coverage criteria in such tools, the plan will need to understand and explain the external clinical evidence relied upon in these products and how the evidence supports the coverage criteria applied by these tools. According to CMS, although an MA plan could possibly use such tools to create internal coverage criteria that comply with the requirements discussed above, “use of these tools, in isolation, without compliance with the requirements in this final rule . . . is prohibited.”   

Two-Midnight Rule vs. Two-Midnight Presumption

CMS confirmed in preamble discussion that MA plans are required to follow regulations establishing the so-called “Two-Midnight Rule” (when the admitting physician expects the patient to require hospital care that crosses two midnights) and the Two-Midnight “Case-by-Case Exception” (when the admitting physician does not expect the patient to require care that crosses two midnights but determines, based on complex medical factors documented in the medical record, that inpatient care is nonetheless necessary). However, according to CMS, MA plans are not required to follow the Two-Midnight presumption, which is a CMS medical review instruction requiring traditional Medicare contractors to presume that hospital stays spanning two or more midnights after the beneficiary is formally admitted as an inpatient are reasonable and necessary for Part A payment. CMS noted that MA plans may still use prior authorization or concurrent case management review of inpatient admissions based on whether the complex medical factors documented in the medical record support medical necessity of the inpatient admission, under either the Two-Midnight Rule or the Case-by-Case Exception. CMS also confirmed that the “Inpatient-Only List,” which specifies procedures covered only when provided in the inpatient setting, applies to MA plans.

Prior Authorization and Continuity of Care Requirements for Coordinated Care Plans

The Final Rule sets new prior authorization and continuity of care requirements for MA coordinated care plans, defined as plans that include a network of providers that are under contract or arrangement with the MA organization to deliver the benefit package approved by CMS. (The majority of MA plans are coordinated care plans.)

The Final Rule amends the MA regulations to require that the prior authorization policies of MA coordinated care plans may only be used to confirm the presence of diagnoses or other medical criteria and/or ensure that an item or service is medically necessary (or clinically appropriate in the case of certain supplemental benefits). 42 C.F.R. § 422.138(b).  CMS emphasized that prior authorization should not function to delay or discourage care.

The Final Rule further requires that when an MA coordinated care plan approves a prior authorization request for a course of treatment, the approval must be valid for as long as medically necessary to avoid disruptions in care in accordance with applicable coverage criteria, the patient’s medical history, and the treating provider’s recommendation. 42 C.F.R. § 422.112(b)(8)(i)(A). For example, if an MA coordinated care plan has approved a prescribed course of treatment for 90 days, the MA plan may not subject the approved service to additional prior authorization requirements before completion of the approved 90-day period. According to CMS, this change comes in response to evidence that MA plans often require repetitive prior approvals for needed services, even when enrollees have a previously approved course of treatment, plan of care, or are receiving ongoing treatments for a chronic condition.   

The Final Rule also establishes continuity of care requirements for beneficiaries currently undergoing treatment who switch to a different MA coordinated care plan or newly enroll in an MA coordinated care plan.  In particular, during the initial 90 days of such enrollee’s enrollment in the MA plan, the plan may not require prior authorization for the active course of treatment, even when the treatment is being provided by a nonparticipating provider. 42 C.F.R. § 422.112(b)(8)(i)(B). For example, if an enrollee has a procedure or surgery planned for January 31st at the time of enrollment in a new MA plan effective January 1st, the new MA plan may not subject the procedure to a prior authorization requirement, because it is within the 90-day post-enrollment time frame. The planned surgery would be part of an active course of treatment and thus could not be subjected to a new prior authorization requirement under the new MA coordinated care plan. After the 90-day period is complete (or the course of treatment has concluded, whichever comes first), the new plan may direct care through in-network providers and apply prior authorization requirements. Although an MA coordinated care plan cannot deny coverage of an active course of treatment during the 90-day time frame based on a prior authorization requirement, CMS clarified that the plan still is permitted to review the services against permissible coverage criteria when determining coverage and payment.

Retroactive Denials

Under the Final Rule, if an MA plan approves the furnishing of an item or service through a prior authorization or pre-service determination of coverage or payment, it may not deny coverage later based on lack of medical necessity and may not reopen the decision for any reason except for good cause or if there is reliable evidence of fraud or similar fault. 42 C.F.R. § 422.138(c).

Adverse Medical Necessity Decisions

CMS also is revising its regulations to state that if an MA plan expects to issue a partially or fully adverse medical necessity decision based on the initial review of a coverage request, the plan’s determination must be reviewed by a physician or other appropriate health care professional with expertise in the field of medicine or health care that is appropriate for the service at issue before the plan issues the determination decision. The reviewer need not be of the same specialty or subspecialty as the treating physician or other healthcare professional. 42 C.F.R. § 422.566(d). This is the same standard of review with respect to expertise that currently applies to physician review of reconsiderations at 42 C.F.R. § 422.590(h)(2).

UM Committee

To ensure that UM policies including prior authorization are being used appropriately, CMS is requiring all MA plans to establish a UM Committee to review policies annually and ensure consistency with traditional Medicare NCDs, LCDs, and guidelines. The UM Committee must document in writing the reason for its decisions regarding the development of UM policies and make this documentation available to CMS upon request. The UM Committee must be led by the plan’s medical director and include the following: (i) a majority of members who are practicing physicians; (ii) at least one practicing physician who is independent and free of conflict relative to the MA organization and MA plan; (iii) at least one practicing physician who is an expert regarding care of elderly or disabled individuals; and (iv) members representing various clinical specialties (for example, primary care or behavioral health). Under the Final Rule, an MA plan may not use any UM policies for basic or supplemental benefits on or after January 1, 2024 unless those policies and procedures have been reviewed and approved by the UM Committee. A plan may use existing committees, such as the Pharmacy & Therapeutics (P&T) Committee, provided that all regulatory requirements are met. 42 C.F.R. § 422.137.


The new UM regulations will be applicable to MA coverage beginning January 1, 2024 and will give providers important new tools to help limit abusive UM practices by MA plans. K&S managed care contracting and litigation specialists are available to help answer any questions you may have about the new Final Rule.