(a) General rule. The contract between the Part D plan sponsor and CMS must contain the provisions specified in paragraph (b) of this section.

(b) Requirements for contracts. The Part D plan sponsor agrees to—

(1) All the applicable requirements and conditions set forth in this part and in general instructions.

(2) Accept new enrollments, make enrollments effective, process voluntary disenrollments, and limit involuntary disenrollments, as provided in subpart B of this part.

(3) Comply with the prohibition in §423.34(a) on discrimination in beneficiary enrollment.

(4) Provide the basic prescription drug coverage as defined under §423.100 and, to the extent applicable, supplemental benefits as defined in §423.100. (Fallback entities may offer only standard prescription drug coverage as specified in §423.855.)

(5) Disclose information to beneficiaries in the manner and the form specified by CMS under §423.128.

(6) Operate quality assurance, cost and utilization management, medication therapy management, and support e-prescribing as required under subpart D of this part.

(7) Comply with all requirements in subpart M of this part governing coverage determinations, grievances, and appeals, and formulary exceptions.

(8) Comply with the disclosure and reporting requirements in §423.505(f), §423.514, and the requirements in §423.329(b) of this part for submitting current and prior drug claims and related information to CMS for its use in risk adjustment calculations and for the purposes of implementing §423.505(f), (l), and (m) and §423.329(b) of this part.

(9) Provide CMS with the information CMS determines is necessary to carry out payment provisions in subpart G of this part (or for fallback entities, the information necessary to carry out the payment provisions in subpart Q of this part).

(10) Allow CMS to inspect and audit any books and records of a Part D plan sponsor and its delegated first tier, downstream and related entities, that pertain to the information regarding costs provided to CMS under paragraph (b)(9) of this section, or, if a fallback entity, the information submitted under subpart Q of this part.

(11) Be paid under the contract in accordance with the payment rules in subpart G of this part, or, if a fallback entity, in accordance with the payment rules of subpart Q of this part.

(12) Except for fallback entities, submit a future year's bid, including all required information on premiums, benefits, and cost-sharing, by any applicable due date, as provided in subpart F so that CMS and the Part D plan sponsor may conduct negotiations regarding the terms and conditions of the proposed bid and benefit plan renewal.

(13) Permit CMS to determine that it is not qualified to renew its contract or that its contract may be terminated in accordance with this subpart and subpart N of this part. (Subpart N applies to fallback entities only to the extent a fallback contract is terminated.)

(14) Comply with the confidentiality and enrollee record accuracy specified in §423.136.

(15) Comply with State law and preemption by Federal law requirements described in subpart I of this part.

(16) Comply with the coordination requirements with SPAPs and plans that provide other prescription drug coverage as described in subpart J of this part.

(17) Provide benefits by means of point of service systems to adjudicate in a drug claims in a timely and efficient manner in compliance with CMS standards, except when necessary to provide access in underserved areas, I/T/U pharmacies (as defined in §423.100), and long-term care pharmacies (as defined in §423.100).

(18) To agree to have a standard contract with reasonable and relevant terms and conditions of participation whereby any willing pharmacy may access the standard contract and participate as a network pharmacy including all of the following:

(i) Making standard contracts available upon request from interested pharmacies no later than September 15 of each year for contracts effective January 1 of the following year.

(ii) Providing a copy of a standard contract to a requesting pharmacy within 7 business days after receiving such a request from the pharmacy.

(19) Effective contract year 2010, include the prompt payment provisions described in §423.520.

(20) Effective contract year 2010, provide that pharmacies located in, or having a contract with, a long-term care facility (as defined in §423.100) must have not less than 30 days, nor more than 90 days, to submit to the Part D sponsor claims for reimbursement under the plan.

(21)

(i) Update any prescription drug pricing standard (as defined in §423.501) based on the cost of the drug used for reimbursement of network pharmacies by the Part D sponsor on January 1 of each contract year and not less frequently than once every 7 days thereafter;

(ii) Indicate the source used for making any such updates; and

(iii) Disclose all individual drug prices to be updated to the applicable pharmacies in advance of their use for reimbursement of claims, if the source for any prescription drug pricing standard is not publicly available.

(22) Address complaints received by CMS against the Part D sponsor by—

(i) Addressing and resolving complaints in the CMS complaint tracking system.

(ii) Displaying a link to the electronic complaint form on the Medicare.gov Internet Web site on the Part D plan's main Web page.

(23) Maintain a fiscally sound operation by at least maintaining a positive net worth (total assets exceed total liabilities).

(24) Provide applicable beneficiaries with applicable discounts on applicable drugs in accordance with the requirements in subpart W of part 423.

(25) Maintain administrative and management capabilities sufficient for the organization to organize, implement, and control the financial, communication, benefit administration, and quality assurance activities related to the delivery of Part D services.

(26) Maintain a Part D summary plan rating score of at least 3 stars under the 5-star rating system specified in subpart 186 of this part 423. A Part D summary plan rating is calculated as provided in §423.186.

(27) Pass an essential operations test prior to the start of the benefit year. This provision only applies to new sponsors that have not previously entered into a Part D contract with CMS and neither it, nor another subsidiary of the applicant's parent organization, is offering Part D benefits during the current year.

(c) Communication with CMS. The Part D plan sponsor must have the capacity to communicate with CMS electronically in accordance with CMS requirements.

(d) Maintenance of records. The Part D plan sponsor agrees to maintain, for 10 years, books, records, documents, and other evidence of accounting procedures and practices that-

(1) Are sufficient to do the following:

(i) Accommodate periodic auditing of the financial records (including data related to Medicare utilization, costs, and computation of the bid of part D plan sponsors).

(ii) Enable CMS to inspect or otherwise evaluate the quality, appropriateness, and timeliness of services performed under the contract and the facilities of the organization.

(iii) Enable CMS to audit and inspect any books and records of the Part D plan sponsor that pertain to the ability of the organization to bear the risk of potential financial losses, or to services performed or determinations of amounts payable under the contract.

(iv) Except for fallback entities, properly reflect all direct and indirect costs claimed to have been incurred and used in the preparation of the Part D plan sponsor's bid and necessary for the calculation of gross covered prescription drug costs, allowable reinsurance costs, and allowable risk corridor costs (as defined in §423.308).

(v) Except for fallback entities, establish the basis for the components, assumptions, and analysis used by the Part D plan in determining the actuarial valuation of standard, basic alternative, or enhanced alternative coverage offered in accordance with the CMS guidelines specified in §423.265(c)(3).

(2) Include records of the following:

(i) Ownership and operation of the Part D sponsor's financial, medical, and other record keeping systems.

(ii) Financial statements for the current contract period and 10 prior periods.

(iii) Federal income tax or informational returns for the current contract period and 10 prior periods.

(iv) Asset acquisition, lease, sale, or other actions.

(v) Agreements, contracts, and subcontracts.

(vi) Franchise, marketing, and management agreements.

(vii) Matters pertaining to costs of operations.

(viii) Amounts of income received by source and payment.

(ix) Cash flow statements.

(x) Any financial reports filed with other Federal programs or State authorities.

(xi) All prescription drug claims for the current contract period and 10 prior periods.

(xii) All price concessions (including concessions offered by manufacturers) for the current contract period and 10 prior periods accounted for separately from other administrative fees.

(e) Access to facilities and records. The Part D plan sponsor agrees to the following:

(1) HHS, the Comptroller General, or their designee may evaluate, through audit, inspection, or other means—

(i) The quality, appropriateness, and timeliness of services furnished to Medicare enrollees under the contract;

(ii) Compliance with CMS requirements for maintaining the privacy and security of protected health information and other personally identifiable information of Medicare enrollees;

(iii) The facilities of the Part D sponsor to include computer and other electronic systems; and

(iv) The enrollment and disenrollment records for the current contract period and 10 prior periods.

(2) The Part D plan sponsor agrees to make available to HHS, the Comptroller General, or their designees, for the purposes specified in paragraph (d) of this section, its premises, physical facilities and equipment, records relating to its Medicare enrollees, and any additional relevant information that CMS may require. The Part D plan sponsor also agrees to make available any books, contracts, records and documentation of the Part D plan sponsor, first tier, downstream and related entity(s), or its transferee that pertain to any aspect of services performed, reconciliation of benefit liabilities, and determination of amounts payable under the contract, or as the Secretary may deem necessary to enforce the contract.

(3) The Part D plan sponsor agrees to make available, for the purposes specified in paragraph (d) of this section, its premises, physical facilities and equipment, records relating to its Medicare enrollees, and any additional relevant information that CMS may require.

(4) HHS, the Comptroller General, or their designee's right to inspect, evaluate, and audit extends through 10 years from the end of the final contract period or completion of audit, whichever is later unless—

(i) CMS determines there is a special need to retain a particular record or group of records for a longer period and notifies the Part D plan sponsor at least 30 days before the normal disposition date;

(ii) There is a termination, dispute, or allegation of fraud or similar fault by the Part D plan sponsor, in which case the retention may be extended to 6 years from the date of any resulting final resolution of the termination, dispute, or fraud or similar fault; or

(iii) CMS determines that there is a reasonable possibility of fraud or similar fault, in which case CMS may inspect, evaluate, and audit the Part D plan sponsor at any time.

(f) Disclosure of information. The Part D plan sponsor agrees to submit to CMS—

(1) Certified financial information that must include the following:

(i) Information as CMS may require demonstrating that the organization has a fiscally sound operation.

(ii) Information as CMS may require pertaining to the disclosure of ownership and control of the Part D plan sponsor.

(2) All information to CMS that is necessary for CMS to administer and evaluate the program and to simultaneously establish and facilitate a process for current and prospective beneficiaries to exercise choice in obtaining prescription drug coverage. This information includes, but is not limited to:

(i) The benefits covered under a Part D plan.

(ii) The Part D plan monthly basic beneficiary premium and Part D plan monthly supplemental beneficiary premium, if any, for the plan. Fallback entities submit the monthly beneficiary premium for standard prescription drug coverage.

(iii) The service area of each plan.

(iv) Plan quality and performance indicators for the benefits under the plan including—

(A) Disenrollment rates for Medicare enrollees electing to receive benefits through the plan for the previous 2 years;

(B) Information on Medicare enrollee satisfaction;

(C) The recent records regarding compliance of the plan with requirements of this part, as determined by CMS; and

(D) Other information determined by CMS to be necessary to assist beneficiaries in making an informed choice regarding Part D plans.

(v) Information about beneficiary appeals and their disposition, and formulary exceptions.

(vi) Information regarding all formal actions, reviews, findings, or other similar actions by States, other regulatory bodies, or any other certifying or accrediting organization.

(vii) Information on other matters that CMS may require, including, but not limited to, program monitoring and oversight, performance measures, quality assessment, research and evaluation, CMS outreach activities, payment-related oversight*, and fraud, abuse, and waste*, as specified in CMS guidelines.

(viii) Any other information deemed necessary to CMS for the administration or evaluation of the Medicare program.

(3) All data elements included in all its drug claims for purposes deemed necessary and appropriate by the Secretary, including, but not limited to the following:

(i) Reporting to Congress and the public on overall statistics associated with the operation of the Medicare prescription drug program.

(ii) Conducting evaluations of the overall Medicare program, including the interaction between prescription drug coverage under Part D of Title XVIII of the Social Security Act and the services and utilization under Parts A, B, and C of title XVIII of the Act and under titles XIX and XXI of the Act, as well as other studies addressing public health questions.

(iii) Making legislative proposals to the Congress regarding Federal health care programs and related programs.

(iv) Conducting demonstration and pilot projects and making recommendations for improving the economy, efficiency, or effectiveness of the Medicare program.

(v) Supporting care coordination and disease management programs.

(vi) Supporting quality improvement and performance measurement activities.

(vii) Populating personal health care records.

(viii) Supporting program integrity purposes, including coordination with the States.

(4) To its enrollees, all informational requirements under §423.128 and, upon an enrollee's request, the financial disclosure information required under §423.128(c)(4).

(g) Beneficiary financial protections. The Part D plan sponsor agrees to comply with the following requirements:

(1) Each Part D plan sponsor must adopt and maintain arrangements satisfactory to CMS to protect its enrollees from incurring liability for payment of any fees that are the legal obligation of the Part D sponsor. To meet this requirement, the Part D plan sponsor must—

(i) Ensure that all contractual or other written arrangements prohibit the sponsor's contracting agents from holding any beneficiary enrollee liable for payment of any such fees; and

(ii) Indemnify the beneficiary enrollee for payment of any fees that are the legal obligation of the Part D plan sponsor for covered prescription drugs furnished by non-contracting pharmacists, or that have not otherwise entered into an agreement with the Part D plan sponsor, to provide services to the organization's beneficiary enrollees.

(2) In meeting the requirements of this paragraph, other than the provider contract requirements specified in paragraph (g)(1)(i) of this section, the Part D plan sponsor may use—

(i) Contractual arrangements;

(ii) Insurance acceptable to CMS;

(iii) Financial reserves acceptable to CMS; or

(iv) Any other arrangement acceptable to CMS.

(h) Requirements of other laws and regulations. The Part D plan sponsor agrees to comply with—

(1) Federal laws and regulations designed to prevent fraud, waste, and abuse, including, but not limited to applicable provisions of Federal criminal law, the False Claims Act (31 U.S.C. 3729 et seq.), and the anti-kickback statute (section 1128B(b) of the Act).

(2) HIPAA Administrative Simplification rules at 45 CFR parts 160, 162, and 164.

(i) Relationship with first tier, downstream, and related entities.

(1) Notwithstanding any relationship(s) that the Part D plan sponsor may have with first tier, downstream, and related entities, the Part D sponsor maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS.

(2) The Part D sponsor agrees to require all first tier, downstream, and related entities to agree that—

(i) HHS, the Comptroller General, or their designees have the right to audit, evaluate, collect, and inspect any books, contracts, computer or other electronic systems, including medical records and documentation of the first tier, downstream, and related entities related to CMS' contract with the Part D sponsor.

(ii) HHS, the Comptroller General or their designees have the right to audit, evaluate, collect, and inspect any records under paragraph (i)(2)(i) of this section directly from any first tier, downstream, or related entity.

(iii) For records subject to review under paragraph (i)(2)(ii) of this section, except in exceptional circumstances, CMS will provide notification to the Part D sponsor that a direct request for information has been initiated.

(iv) HHS', the Comptroller General's, or their designee's right to inspect, evaluate, and audit any pertinent information for any particular contract period exists through 10 years from the final date of the contract period or from the date of completion of any audit, whichever is later.

(3) Each and every contract governing Part D sponsors and first tier, downstream, and related entities, must contain the following:

(i) Enrollee protection provisions that provide, consistent with paragraph (g)(1) of this section, arrangements that prohibit pharmacies or other providers from holding an enrollee liable for payment of any fees that are the obligation of the Part D plan sponsor.

(ii) Accountability provisions that indicate that the Part D sponsor may delegate activities or functions to a first tier, downstream, or related entity only in a manner consistent with requirements set forth at paragraph (i)(4) of this section.

(iii) A provision requiring that any services or other activity performed by a first tier, downstream, and related entity in accordance with a contract are consistent and comply with the Part D sponsor's contractual obligations.

(iv) Each and every contract must specify that first tier, downstream, and related entities must comply with all applicable Federal laws, regulations, and CMS instructions.

(v) A provision requiring prompt payment of clean claims by the Part D sponsor, consistent with §423.520.

(vi) A provision that establishes timeframes, consistent with §423.505(b)(20), for long-term care pharmacies to submit claims to the Part D sponsor for reimbursement under the plan.

(vii) If applicable, provisions addressing the drug pricing standard requirements of §423.505(b)(21).

(4) If any of the Part D plan sponsors' activities or responsibilities under its contract with CMS is delegated to other parties, the following requirements apply to any first tier, downstream, and related entity:

(i) Each and every contract must specify delegated activities and reporting responsibilities.

(ii) Each and every contract must either provide for revocation of the delegation activities and reporting responsibilities described in paragraph (i)(4)(i) of this section or specify other remedies in instances when CMS or the Part D plan sponsor determine that the parties have not performed satisfactorily.

(iii) Each and every contract must specify that the Part D plan sponsor on an ongoing basis monitors the performance of the parties.

(iv) Each and every contract must specify that the related entity, contractor, or subcontractor must comply with all applicable Federal laws, regulations, and CMS instructions.

(5) If the Part D plan sponsor delegates selection of its prescription drug providers to another organization, the Part D sponsor's written arrangements with that organization must state that the CMS-contracting Part D plan sponsor retains the right to approve, suspend, or terminate any such arrangement.

(j) Additional contract terms. The Part D plan sponsor agrees to include in the contract other terms and conditions as CMS may find necessary and appropriate in order to implement requirements in this part.

(k) Certification of data that determine payment—(1) General rule. As a condition for receiving a monthly payment under subpart G of this part (or for fallback entities, payment under subpart Q of this part),, the Part D plan sponsor agrees that its chief executive officer (CEO), chief financial officer (CFO), or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must request payment under the contract on a document that certifies (based on best knowledge, information, and belief) the accuracy, completeness, and truthfulness of all data related to payment. The data may include specified enrollment information, claims data, bid submission data, and other data that CMS specifies.

(2) Certification of enrollment and payment information. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that each enrollee for whom the organization is requesting payment is validly enrolled in a program offered by the organization and the information CMS relies on in determining payment is accurate, complete, and truthful and acknowledge that this information will be used for the purposes of obtaining Federal reimbursement.

(3) Certification of claims data. The CEO, CFO, or an individual delegated with the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the claims data it submits under §423.329(b)(3) (or for fallback entities, under §423.871(f)) are accurate, complete, and truthful and acknowledge that the claims data will be used for the purpose of obtaining Federal reimbursement. If the claims data are generated by a related entity, contractor, or subcontractor of a Part D plan sponsor, the entity, contractor, or subcontractor must similarly certify (based on best knowledge, information, and belief) the accuracy, completeness, and truthfulness of the data and acknowledge that the claims data will be used for the purposes of obtaining Federal reimbursement.

(4) Certification of bid submission information. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information in its bid submission and assumptions related to projected reinsurance and low income cost sharing subsidies is accurate, complete, and truthful and fully conforms to the requirements in §423.265.

(5) Certification of allowable costs for risk corridor and reinsurance information. The Chief Executive Officer, Chief Financial Officer, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information provided for purposes of supporting allowable costs as defined in §423.308 of this part, including data submitted to CMS regarding direct or indirect remuneration (DIR) that serves to reduce the costs incurred by the Part D sponsor for Part D drugs, is accurate, complete, and truthful and fully conforms to the requirements in §423.336 and §423.343 of this part and acknowledge that this information will be used for the purposes of obtaining Federal reimbursement.

(6) Certification of accuracy of data for price comparison. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information provided for purposes of price comparison is accurate, complete, and truthful.

(7) Certification of accuracy of data for overpayments. The CEO, CFO, or COO must certify (based on best knowledge, information, and belief) that the information provided for purposes of reporting and returning of overpayments under §423.360 is accurate, complete, and truthful.

(l) CMS may use the information collected under paragraph (f)(3) of this section. Any restriction set forth by §423.322(b) of this part must not be construed to limit the Secretary's authority to use the information collected under paragraph (f)(3).

(m) Release of data.

(1) CMS may release the minimum data necessary for a given purpose from the data collected under paragraph (f)(3) of this section to Federal executive branch agencies, States, and external entities in accordance with the following:

(i) Applicable Federal laws.

(ii) CMS data sharing procedures.

(iii) Subject, in certain cases, to encryption of beneficiary identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors, in accordance with all of the following principles:

(A) Subject to the restrictions in this paragraph, all elements on the claim are available to HHS, other executive branch agencies, and the States.

(B) Cost data elements on the claim generally are aggregated for releases to other executive branch agencies, States, and external entities. Upon request, CMS excludes sales tax from the aggregation at the individual level if necessary for the project.

(C) Beneficiary identifier elements on the claim generally are encrypted for release, except in limited circumstances, such as the following:

(1) If needed, in the case of release to other HHS entities, Congressional oversight agencies, non-HHS executive agencies and the States.

(2) If needed to link to another dataset, in the case of release to external entities. Public disclosure of research results will not include beneficiary identifying information.

(iv) For purposes of paragraph (m)(1)(iii) of this section, States and executive-branch Federal agencies are not considered to be external entities.

(2) Any restriction set forth by §423.322(b) of this part must not be construed to limit the Secretary's authority to release the information collected under paragraph (f)(3) of this section.

(3)

(i) CMS must make available to Congressional support agencies (the Congressional Budget Office, the Government Accountability Office, the Medicare Payment Advisory Commission, and the Congressional Research Service when it is acting on behalf of a Congressional committee in accordance with 2 U.S.C. 166(d)(1)) all information collected under paragraph (f)(3) of this section for the purposes of conducting congressional oversight, monitoring, making recommendations, and analysis of the Medicare program.

(ii) The Congressional Research Service is considered an external entity when it is not acting on behalf of a Congressional committee in accordance with 2 U.S.C. 166(d)(1) for the purposes of paragraph (m)(1) of this section.

(n)

(1) CMS may determine that a Part D plan sponsor is out of compliance with a Part D requirement when the sponsor fails to meet performance standards articulated in the Part D statutes, regulations, or guidance.

(2) If CMS has not already articulated a measure for determining noncompliance, CMS may determine that a Part D sponsor is out of compliance when its performance in fulfilling Part D requirements represents an outlier relative to the performance of other Part D sponsors.

(o) Acknowledgements of CMS release of data—(1) Summary CMS payment data. The contract must provide that the Part D sponsor acknowledges that CMS releases to the public summary reconciled Part D payment data after the reconciliation of Part D payments for the contract year as follows:

(i) The average per member per month Part D direct subsidy standardized to the 1.0 (average risk score) beneficiary for each Part D plan offered.

(ii) The average Part D risk score for each Part D plan offered.

(iii) The average per member per month Part D plan low-income cost sharing subsidy for each Part D plan offered.

(iv) The average per member per month Part D Federal reinsurance subsidy for each Part D plan offered.

(v) The actual Part D reconciliation payment data summarized at the Parent Organization level including breakouts of risk sharing, reinsurance, and low income cost sharing reconciliation amounts.

(2) Part D MLR data. The contract must provide that the Part D sponsor acknowledges that CMS releases to the public data as described at §423.2490.

(p) Business continuity.

(1) The Part D sponsor agrees to develop, maintain, and implement a business continuity plan containing policies and procedures to ensure the restoration of business operations following disruptions to business operations during disruptions to business operations which would include natural or man-made disasters, system failures, emergencies, and other similar circumstances and the threat of such occurrences. To meet the requirement, the business continuity plan must, at a minimum, include the following:

(i) Risk assessment. Identify threats and vulnerabilities that might affect business operations.

(ii) Mitigation strategy. Design strategies to mitigate hazards. Identify essential functions in addition to those specified in paragraph (p)(2) of this section and prioritize the order in which to restore all other functions to normal operations. At a minimum, each Part D sponsor must do the following:

(A) Identify specific events that will activate the business continuity plan.

(B) Develop a contingency plan to maintain, during any business disruption, the availability and, as applicable, confidentiality of communication systems and essential records in all forms (including electronic and paper copies). The contingency plan must do the following:

(1) Ensure that during any business disruption the following systems will operate continuously or, should they fail, be restored to operational capacity on a timely basis:

(i) Information technology (IT) systems including those supporting claims processing at point of service.

(ii) Provider and enrollee communication systems including telephone, Web site, and email.

(2) With respect to electronic protected health information, comply with the contingency plan requirements of the Health Insurance Portability and Accountability Act of 1996 Security Regulations at 45 CFR parts 160 and 164, subparts A and C.

(C) Establish a chain of command.

(D) Establish a business communication plan that includes emergency capabilities and procedures to contact and communicate with the following:

(1) Employees.

(2) First tier, downstream, and related entities.

(3) Other third parties (including pharmacies, providers, suppliers, and government and emergency management officials).

(E) Establish employee and facility management plans to ensure that essential operations and job responsibilities can be assumed by other employees or moved to alternate sites as necessary or both.

(F) Establish a restoration plan including procedures to transition to normal operations.

(G) Comply with all applicable Federal, State, and local laws.

(iii) Testing and revision. On at least an annual basis, test and update the business operations continuity plan to ensure the following:

(A) That it can be implemented in emergency situations.

(B) That employees understand how it is to be executed.

(iv) Training. On at least an annual basis, educate appropriate employees about the business continuity plan and their own respective roles.

(v) Records.

(A) Develop and maintain records documenting the elements of the business continuity plan described in paragraph (p)(1)(i) through (iv) of this section.

(B) Make the information specified in paragraph (p)(1)(v)(A) of this section available to CMS upon request.

(2) Restoration of essential functions. Every Part D sponsor must plan to restore essential functions within 72 hours after any of the essential functions fail or otherwise stop functioning as usual. In addition to any essential functions that the Part D sponsor identifies under paragraph (p)(1)(ii) of this section, for purposes of this paragraph (p)(2) of this section essential functions include at a minimum, the following:

(i) Benefit authorization (if not waived), adjudication, and processing of prescription drug claims at the point of sale.

(ii) Administration and tracking of enrollees' drug benefits in real time, including automated coordination of benefits with other payers.

(iii) Provision of pharmacy technical assistance.

(iv) Operation of an enrollee exceptions and appeals process including coverage determinations.

(v) Operation of call center customer services.

[70 FR 4525, Jan. 28, 2005, as amended at 73 FR 20507, Apr. 15, 2008; 73 FR 30683, May 28, 2008; 73 FR 54251, Sept. 18, 2008; 73 FR 70599, Nov. 21, 2008; 74 FR 1545, Jan. 12, 2009; 75 FR 19821, Apr. 15, 2010; 76 FR 21574, Apr. 15, 2011; 76 FR 54634, Sept. 1, 2011; 77 FR 22170, Apr. 12, 2012; 79 FR 29964, May 23, 2014; 80 FR 7964, Feb. 12, 2015; 81 FR 80557, Nov. 15, 2016; 83 FR 16750, Apr. 16, 2018]