(a) Applicability. The requirements of this section apply to any contract or written arrangement that an MCO, PIHP, PAHP, or PCCM entity has with any subcontractor.

(b) General rule. The State must ensure, through its contracts with MCOs, PIHPs, PAHPs, and PCCM entities that—

(1) Notwithstanding any relationship(s) that the MCO, PIHP, PAHP, or PCCM entity may have with any subcontractor, the MCO, PIHP, PAHP, or PCCM entity maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with the State; and

(2) All contracts or written arrangements between the MCO, PIHP, PAHP, or PCCM entity and any subcontractor must meet the requirements of paragraph (c) of this section.

(c) Each contract or written arrangement described in paragraph (b)(2) of this section must specify that:

(1) If any of the MCO's, PIHP's, PAHP's, or PCCM entity's activities or obligations under its contract with the State are delegated to a subcontractor—

(i) The delegated activities or obligations, and related reporting responsibilities, are specified in the contract or written agreement.

(ii) The subcontractor agrees to perform the delegated activities and reporting responsibilities specified in compliance with the MCO's, PIHP's, PAHP's, or PCCM entity's contract obligations.

(iii) The contract or written arrangement must either provide for revocation of the delegation of activities or obligations, or specify other remedies in instances where the State or the MCO, PIHP, PAHP, or PCCM entity determine that the subcontractor has not performed satisfactorily.

(2) The subcontractor agrees to comply with all applicable Medicaid laws, regulations, including applicable subregulatory guidance and contract provisions;

(3) The subcontractor agrees that—

(i) The State, CMS, the HHS Inspector General, the Comptroller General, or their designees have the right to audit, evaluate, and inspect any books, records, contracts, computer or other electronic systems of the subcontractor, or of the subcontractor's contractor, that pertain to any aspect of services and activities performed, or determination of amounts payable under the MCO's, PIHP's, or PAHP's contract with the State.

(ii) The subcontractor will make available, for purposes of an audit, evaluation, or inspection under paragraph (c)(3)(i) of this section, its premises, physical facilities, equipment, books, records, contracts, computer or other electronic systems relating to its Medicaid enrollees.

(iii) The right to audit under paragraph (c)(3)(i) of this section will exist through 10 years from the final date of the contract period or from the date of completion of any audit, whichever is later.

(iv) If the State, CMS, or the HHS Inspector General determines that there is a reasonable possibility of fraud or similar risk, the State, CMS, or the HHS Inspector General may inspect, evaluate, and audit the subcontractor at any time.

(d) Applicability date. This section applies to the rating period for contracts with MCOs, PIHPs, PAHPs, and PCCM entities beginning on or after July 1, 2017. Until that applicability date, states are required to continue to comply with §438.230 contained in the 42 CFR parts 430 to 481, edition revised as of October 1, 2015.