(a) Right to audit. The ACO must agree, and must require its ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities to agree, that the CMS, DHHS, the Comptroller General, the Federal Government or their designees have the right to audit, inspect, investigate, and evaluate any books, contracts, records, documents and other evidence of the ACO, ACO participants, and ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities that pertain to all of the following:

(1) The ACO's compliance with Shared Savings Program.

(2) The quality of services performed and determination of amount due to or from CMS under the participation agreement.

(3) The ability of the ACO to bear the risk of potential losses and to repay any losses to CMS.

(4) The ACO's operation of a beneficiary incentive program.

(b) Maintenance of records. An ACO must agree, and must require its ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities to agree to the following:

(1) To maintain and give CMS, DHHS, the Comptroller General, the Federal Government or their designees access to all books, contracts, records, documents, and other evidence (including data related to Medicare utilization and costs, quality performance measures, shared savings distributions, information related to operation of a beneficiary incentive program, and other financial arrangements related to ACO activities) sufficient to enable the audit, evaluation, investigation, and inspection of the ACO's compliance with program requirements, quality of services performed, right to any shared savings payment, or obligation to repay losses, ability to bear the risk of potential losses, and ability to repay any losses to CMS.

(2) To maintain such books, contracts, records, documents, and other evidence for a period of 10 years from the final date of the agreement period or from the date of completion of any audit, evaluation, or inspection, whichever is later, unless—

(i) CMS determines there is a special need to retain a particular record or group of records for a longer period and notifies the ACO at least 30 days before the normal disposition date; or

(ii) There has been a termination, dispute, or allegation of fraud or similar fault against the ACO, its ACO participants, its ACO providers/suppliers, or other individuals or entities performing functions or services related to ACO activities, in which case ACOs must retain records for an additional 6 years from the date of any resulting final resolution of the termination, dispute, or allegation of fraud or similar fault.

(c) Responsibility of the ACO. Notwithstanding any arrangements between or among an ACO, ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to ACO activities, the ACO must have ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its participation agreement with CMS, including the requirements set forth in this section.

(d) OIG authority. None of the provisions of this part limit or restrict OIG's authority to audit, evaluate, investigate, or inspect the ACO, its ACO participants, its ACO providers/suppliers and other individuals or entities performing functions or services related to ACO activities.

[76 FR 67973, Nov. 2, 2011, as amended at 80 FR 32840, June 9, 2015; 81 FR 38013, June 10, 2016; 83 FR 68068, Dec. 31, 2018]