(a) Monitoring contractor compliance. Consistent with §438.66, the State must monitor the MCO's, PIHP's, PAHP's, PCCM's or PCCM entity's compliance, as applicable, with §§438.604, 438.606, 438.608, 438.610, 438.230, and 438.808.

(b) Screening and enrollment and revalidation of providers.

(1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries.

(2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees.

(c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in §438.608(c).

(d) Federal database checks. Consistent with the requirements at §455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with §438.610(c).

(e) Periodic audits. The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.

(f) Whistleblowers. The State must receive and investigate information from whistleblowers relating to the integrity of the MCO, PIHP, PAHP, PCCM, or PCCM entity, subcontractors, or network providers receiving Federal funds under this part.

(g) Transparency. The State must post on its Web site, as required in §438.10(c)(3), the following documents and reports:

(1) The MCO, PIHP, PAHP, or PCCM entity contract.

(2) The data at §438.604(a)(5).

(3) The name and title of individuals included in §438.604(a)(6).

(4) The results of any audits under paragraph (e) of this section.

(h) Contracting integrity. The State must have in place conflict of interest safeguards described in §438.58 and must comply with the requirement described in section 1902(a)(4)(C) of the Act applicable to contracting officers, employees, or independent contractors.

(i) Entities located outside of the U.S. The State must ensure that the MCO, PIHP, PAHP, PCCM, or PCCM entity with which the State contracts under this part is not located outside of the United States and that no claims paid by an MCO, PIHP, or PAHP to a network provider, out-of-network provider, subcontractor or financial institution located outside of the U.S. are considered in the development of actuarially sound capitation rates.