(a) Issuer support of data validation. An issuer that offers risk adjustment covered plans must comply with any data validation requests by the State or HHS on behalf of the State.

(b) Issuer records maintenance requirements. An issuer that offers risk adjustment covered plans must also maintain documents and records, whether paper, electronic, or in other media, sufficient to enable the evaluation of the issuer's compliance with applicable risk adjustment standards, for each benefit year for at least 10 years, and must make those documents and records available upon request to HHS, the OIG, the Comptroller General, or their designees, or in a State where the State is operating risk adjustment, the State or its designee to any such entity, for purposes of verification, investigation, audit or other review.

(c) Audits. HHS or its designee may audit an issuer of a risk adjustment covered plan to assess its compliance with the requirements of this subpart and subpart H of this part. The issuer must ensure that its relevant contractors, subcontractors, or agents cooperate with any audit under this section. If an audit results in a finding of material weakness or significant deficiency with respect to compliance with any requirement of this subpart or subpart H of this part, the issuer must complete all of the following:

(1) Within 30 calendar days of the issuance of the final audit report, provide a written corrective action plan to HHS for approval.

(2) Implement that plan.

(3) Provide to HHS written documentation of the corrective actions once taken.

[77 FR 17245, Mar. 23, 2012, as amended at 78 FR 65095, Oct. 30, 2013; 79 FR 13836, Mar. 11, 2014]