As notable are the many proposals from the May 26, 2023 proposed rule (Proposed Rule) that CMS did not finalize, including the drug price verification survey, broadening the definition of “manufacturer,” and a definition of “vaccine.” CMS also did not finalize its proposal as to Best Price “stacking,” as previously announced in a May 15, 2024 press release.

Even with the agency’s decision to finalize a narrower set of proposals, the Final Rule has the potential to significantly expand the universe of utilization subject to Medicaid rebates (through the covered outpatient drug (COD) definition and physician-administered drug invoicing mandate) and significantly increase the need for manufacturer resources dedicated to data submission oversight and remediation given the Final Rule’s extremely short remediation timelines for addressing misclassification and late data notifications and associated penalties where those timelines are not met. One silver lining is the future requirement that Medicaid managed care beneficiary identification cards include Medicaid-specific billing identifiers, which, once implemented, should support greater prevention of 340B duplicate discounts. As always, please review it carefully to ensure you identify all issues relevant to your organization.

The Final Rule is scheduled to be published in the Federal Register on September 26, 2024. Relevant documentation is as follows:

• The Final Rule
• The Proposed Rule
• Hogan Lovells client alert on the Proposed Rule
• CMS’s press release on the Final Rule

We have prepared two redlines: The first (online here) shows the Final Rule provisions marked against those of the Proposed Rule. The second (online here) shows how the Final Rule modifies existing regulations.

Changes to the MDRP Regulations

• COD “limiting definition.” This definition identifies units of drugs that are subject to MDRP price reporting obligations and, in particular, in the case of this finalized policy, when units of a given COD are subject to rebate liability.

  • Proposed Rule: CMS proposed to amend its interpretation of the statutory “limiting definition” which “excludes from the definition of COD any drug, biological product, or insulin provided as part of or incident to and in the same setting as any one in a list of services [including inpatient services], and for which payment may be made as part of that service instead of as a direct reimbursement for the drug.” Under CMS’s proposal, “direct reimbursement for the drug includes when a claim for payment identifies the drug plus the itemized cost of the drug,” even where a single, bundled payment is made across the drug and associated items and services. This amendment could expand the current understanding of what qualifies as a rebatable COD to include, for example, drugs paid for under a bundled rate, in both the inpatient and outpatient settings.

  • What changed? CMS finalized this proposal with some important modifications, clarifying that “direct reimbursement” can include “[r]eimbursement for a drug alone” or “[r]eimbursement for a drug plus the service, in a single inclusive payment if: (A) [t]he drug, charge for the drug, and number of units of the drug are separately identified on the claim, and; (B) [t]he inclusive payment includes an amount directly attributable to the drug, and, (C) [t]he amount paid that is attributable to the drug is based on a reimbursement methodology that is included in the applicable section of the State plan” (emphasis added). CMS indicates that the proposed modification to the definition of direct reimbursement “was not intended to be a departure from current practice or in conflict with the current regulation or statute.” Instead, CMS indicates that it sought “to address the fact that States are now using newer reimbursement methodologies where it is not entirely clear whether drugs reimbursed through that new methodology are CODs.” CMS states that the modifications as compared to the Proposed Rule were intended “to make it clear that, for rebates to be billed, the inclusive payment must include an amount directly attributable to the drug, and the amount paid that is attributable to the drug is based on a reimbursement methodology that is included in the applicable section of the State plan.”

• • • CMS rejected comments suggesting that the term “outpatient” in “covered outpatient drug” should limit the term’s application to units of drug utilized in the outpatient setting, stating that “the term ‘covered outpatient drug’ is a statutory term of art” and that, if “Congress had intended for the statutory term of ‘COD’ to be limited to the outpatient setting only, the limiting definition would be superfluous as applied to being included in inpatient hospital services.”

• • • CMS also declined to address comments regarding the impact of this revised definition on the 340B Drug Pricing Program, which relies on the same statutory definition of COD. Guidance from the Health Resources and Services Administration (HRSA) currently provides that “if a covered drug is included in the per diem rate (i.e., bundled with other payments in an all-inclusive, per visit, or an encounter rate), it will not be included in the section 340B discount program. However, if a covered drug is billed and paid for instead as a separate line item as an outpatient drug in a cost basis billing system, this drug will be included in the [340B] program.” 59 Fed. Reg. 25,110, 25,113 (May 13, 1994).

• Definition of Drug Product Information.

  • Proposed Rule: CMS proposed to implement a statutory amendment that requires manufacturers to report drug product information by defining such information “as information that includes, but is not limited to, [National Drug Code (NDC)] number, drug name, units per package size (UPPS), drug category (‘S’, ‘I’, ‘N’), unit type (for example, TAB, CAP, ML, EA), drug type (prescription, over-the counter), base date AMP, therapeutic equivalent code (TEC), line extension drug indicator, 5i indicator and route of administration, if applicable, FDA approval date and application number or OTC monograph citation if applicable, market date, COD status, and any other information deemed necessary by the agency to perform accurate [unit rebate amount] calculations” (emphasis added).

  • What changed? CMS finalized this provision largely as proposed but declined to finalize the broad language regarding “any other information deemed necessary." The final definition reads as follows: “Drug product information means National Drug Code (NDC), drug name, units per package size (UPPS), drug category (‘S’, ‘I’, ‘N’), unit type (for example, TAB, CAP, ML, EA), drug type (prescription, over-the-counter), base date AMP, therapeutic equivalent code (TEC), line extension drug indicator, 5i indicator, 5i route of administration (if applicable), FDA approval date, FDA-approved application number or OTC monograph citation (if applicable), market date, and COD status.” The below-discussed penalties for misclassification apply to errors in this information, indicating the importance of manufacturer review of the above-described product data fields for accuracy.

• Misclassifications of Drugs.

  • Proposed Rule: CMS proposed to implement the Medicaid Services Investment and Accountability Act of 2019 (MSIAA), which established certain requirements with respect to misclassified drugs under the MDRP and associated civil monetary penalties (CMPs). In the Proposed Rule, CMS stated that a misclassification of a drug occurs when a manufacturer reports a drug category (single-source or “S” drug, innovator multiple source or “I” drugs, or noninnovator multiple source or “N” drugs) or drug product information that is not supported by the statutory and regulatory definitions or pays rebates to states at a level that does not align with the applicable drug category or drug product information, without apparent consideration of whether the misclassification occurred as a result of a clerical error in the reported information.

CMS proposed to establish a process and timeline for notifying a manufacturer of a misclassification and a process for correcting a misclassification:

• • • 30 days from notification to correct data: Corrections to any misclassification must be made within 30 calendar days of the date of notification (which notice is to be made electronically in writing).

    • 60 days from notification to pay any additional rebate amounts due: Manufacturers must pay any unpaid rebate amounts due to state Medicaid agencies, and provide CMS with documentation of the same, within 60 calendar days of the date of notification.

    • Failure to abide by either deadline could result in CMS:

      1. Correcting the misclassification itself,

      2. Suspending the misclassified drug from the MDRP and Federal Financial Participation (FFP),

      3. Assessing CMPs not to exceed “[t]he total number of units of each dosage form and strength of such misclassified drug paid for under any State Plan during such a rebate period” multiplied by 23.1 percent of average manufacturer price (AMP), and/or

      4. Imposing or facilitating any other penalties available by statute, including referral to the Department of Health and Human Services (HHS) Office of Inspector General (OIG) or termination from the MDRP.

    • CMS would publish a report of misclassified drugs on its website.

CMS stated: “The only situation in which a drug that is produced or marketed under an NDA may be reported as a noninnovator drug is if a narrow exception was granted by CMS in accordance with the process established in the COD final rule.” With respect to narrow exception requests (through which a drug that would otherwise be classified as an S or I drug can be granted an exception by CMS and treated as an N drug), CMS specified that drugs approved under a New Drug Application (NDA) must be listed as an S or I drug unless a narrow exception request has been granted and that a grant of a narrow exception request will apply only “prospectively from the effective date of the COD final rule” (i.e., April 1, 2016). CMS further stated that this proposal would enable the agency “to also pursue penalties against manufacturers that will not change their classification as a result of the denial of their narrow exception request, and would also allow [CMS] to impose penalties on manufacturers that pay a different amount in rebates to States than is supported by the product and pricing data that they are reporting . . . .”

• • What changed? CMS largely finalized these provisions as proposed, but added a new sentence stating that a manufacturer’s obligation to certify any change made in the Medicaid Drug Programs (MDP) system applies to a change made by CMS to correct a misclassification. Such a correction must be certified by the manufacturer within 30 calendar days. Some commenters expressed concern with CMS being able to independently reclassify a misclassified drug, and asked CMS to provide a dispute resolution process for instances where a manufacturer disagrees with the CMS reclassification. CMS stated that it is “implementing what the Congress set forth, which did not propose a dispute resolution process,” but that it “will take this suggestion into consideration for future rulemaking.” As to the 30-day and 60-day calendar day requirements, respectively, to correct a misclassification and pay rebates, CMS adds that it will allow manufacturers in extenuating circumstances to “informally request extensions.”

    • CMS rejected comments seeking to tie the misclassification provisions to the 10-year MDRP record retention requirements, stating that manufacturers may make reasonable assumptions “for reporting data for time periods prior to 10 years if they did not retain documents.”

    • In response to comments regarding the retrospective application of these provisions to reporting periods prior to the effective date of MSIAA, CMS states: “there is no provision in the statute which would exempt manufacturers from their responsibility of correcting their misclassification from before 2019.” Manufacturers should evaluate their processes for timely review and responses to any CMS “notices of non-compliance.” Manufacturers should also evaluate the impact of the finalized policy, if any, on their product data listings, particularly with respect to products that have been approved under an NDA/BLA but are listed as noninnovator products in the MDP system.

    • In response to commenter concerns that, as proposed, misclassifications would include “clerical errors,” CMS noted “we believe misclassification includes any incorrect drug product information reported by the manufacturer.”

• Suspension of Medicaid rebate agreement for late reporting.

  • Proposed Rule: CMS proposed a process for suspension (and possible termination) of a manufacturer’s Medicaid rebate agreement for failure to timely report drug pricing or drug product information.

    • If a manufacturer fails to timely report such information, CMS will provide written notice to the manufacturer of the noncompliance and the manufacturer will have 90 days after such notice to provide all required information.

    • If the manufacturer remains noncompliant after the 90-day period, CMS shall suspend the manufacturer’s Medicaid rebate agreement for all of the manufacturer’s CODs for at least 30 days.

    • Continued suspension could result in termination from the MDRP for cause, inclusive of all associated labeler codes of the manufacturer as well. CMS stated that “suspension of a manufacturer’s rebate agreement under this section applies for Medicaid purposes only, and does not affect manufacturer obligations and responsibilities under the 340B Drug Pricing Program or reimbursement under Medicare Part B during the period of the suspension.”

  • What changed? CMS finalized without change. CMS noted: “manufacturers must still provide drugs through the 340B Program” while their Medicaid rebate agreement is suspended.

• Manufacturer Disputes, Hearings and Audits of State-Provided Information.

  • Proposed Rule: CMS proposed to limit a manufacturer’s ability to “initiate a dispute, request a hearing, or seek audit of a State regarding State drug utilization data” to a period of 12 quarters from the date of the State invoice.

  • What changed? CMS finalized with a revision noting that the relevant period is 12 quarters from the “State invoice postmark date.”

    • CMS stated that it is not requiring disputes be resolved within the 12-quarter period, and that this provision applies to “all newly initiated rebate disputes, regardless of when the claim was processed.”

    • Despite comments requesting the imposition of similar limits on state-initiated disputes and audits, CMS did not implement such a limitation. CMS believes the “2-year claim filing deadline for states under section 1132(A) of the Act . . . provides necessary incentives for States to resolve rebate disputes swiftly, as they must absorb the full cost of a rebate correction, including the portion that would otherwise be paid for through [Federal Financial Participation].” CMS also pointed to the requirement for states to submit invoices no later than 60 days after the end of each quarter, but did not account for state practices of not complying with this requirement.

• Manufacturer requests for restatements outside 12-quarter period following an internal investigation.

  • Proposed Rule: Manufacturers may make restatements of government pricing information outside of the 12-quarter restatement window only for certain reasons, including as the result of an internal investigation. CMS proposed to define an internal investigation as “a manufacturer’s investigation of its AMP, best price, customary prompt pay discounts or nominal prices that have been previously certified in the [MDRP] that results in a finding made by the manufacturer of fraud, abuse, or violation of law or regulation. A manufacturer must make data available to CMS to support its finding.” CMS explained its intent was, in part, to prevent manufacturer requests to revise MDRP data outside of the 12-quarter window with respect to “newly acquired products or lines of business previously certified by the prior manufacturers without making findings that the prior manufacturer violated any law.” Specifically, CMS stated: “Manufacturers should not use the internal investigation exception to permit restatements to allow manufacturers to apply a different methodology or reasonable assumption to determine AMP and best price to its favor when the methodology originally applied was consistent with statute and regulation, and drug product and pricing information was properly reported and certified by the manufacturer at the time.”

  • What changed? CMS finalized the definition of internal investigation but added the term “possible” as indicated below. In response to comments from stakeholders that this definition amounted to a requirement that a manufacturer concede legal liability as a condition of seeking a restatement on these grounds, the amended definition of internal investigation is “a manufacturer’s investigation of its AMP, best price, customary prompt pay discounts, or nominal prices that have been previously certified in the MDRP that results in a finding made by the manufacturer of possible fraud, abuse, or violation of law or regulation.” (emphasis added). CMS stated that the qualifier “possible” was added “so that such restatements would not be construed as an admission of legal fault.”

• Market date.

  • Proposed Rule: CMS proposed “to define market date based on the first sale of the drug, rather than the date the drug was first available for sale.” CMS proposed that “sold” means “the drug has been transferred (including in transit) to a purchasing entity” but expressly solicited comments to determine what qualifies as “sold” for the purposes of determining the market date, and acknowledged that it has “experienced manufacturers interpreting the term ‘sold’ differently across the industry.”

  • What changed? CMS finalized the definition of market date without change. Some commenters urged CMS to not set a definition for “market date” and to allow manufacturers to continue to make reasonable assumptions. CMS nevertheless chose to finalize its proposed definition, noting that a finalized definition “will bring additional consistency to the MDRP and will assist manufacturers in identifying the accurate market date.” CMS also noted that the first sale need not be made to an AMP-eligible entity. CMS did not finalize the proposal of the definition of what qualifies as “sold,” acknowledging that “different manufacturers may record sales dates differently.” And thus CMS “will permit manufacturers to use reasonable assumptions as to the date a sale has occurred.”

    • CMS also stated that, because the definition becomes effective upon the effective date of this Final Rule, “if a manufacturer previously reported a market date based on earlier program instructions that the market date was the earliest date the drug was available for sale by any manufacturer, they will not be required to change the market date to reflect the earliest date the drug was sold by any manufacturer. However, after the effective date of this final rule, manufacturers must use the earliest date the drug was sold as the market date for new drug products.”

    • CMS also noted that, where all sales in the market date month and/or quarter are to AMP-ineligible entities, the reporting manufacturer should make reasonable assumptions when reporting the AMP for that period.

• Definition of N drug.

  • Proposed Rule: CMS proposed to remove the phrase “was not originally marketed” from the definition of an N drug and replace it with “is not marketed.” CMS proposed this change to bring the structure of the definition in line with the structure of the statutory and regulatory definitions of an I drug, which were previously amended to replace “was originally marketed” with “is marketed.”

  • What changed? CMS finalized this provision without change.

• Rescinding provisions of the 2020 final rule related to PBM accumulator programs.

  • Proposed Rule: CMS proposed to rescind the changes to the exclusions from AMP and best price finalized in a December 31, 2020 final rule, which required manufacturers to “ensure” that price concessions were, in fact, passed through to patients for such price concessions to be excluded from the AMP and best price calculations. CMS proposed this change in light of a ruling by the United States District Court for the District of Columbia largely vacating these regulatory changes. We addressed the 2020 final rule in an alert here and the D.C. court decision in an alert here.

  • What changed? CMS finalized this provision without change. CMS noted: “We will continue to explore other ways to protect consumers from accumulator programs that leave vulnerable patient populations with a significant cost-sharing burden once a patient exhausts a manufacturer patient benefit program.”

• Codifying the removal of the AMP cap in regulation.

  • Proposed Rule: CMS proposed to amend its regulations to codify the statutory removal of the cap on AMP, which previously limited the Medicaid unit rebate amount to no more than 100 percent of AMP, but ceased to do so effective January 1, 2024.

  • What changed? CMS finalized this provision without change.

Transparency Between Medicaid Managed Care Plans and PBMs

• Medicaid-specific identifiers on enrollee pharmacy cards.

  • Proposed Rule: To make it easier to distinguish Medicaid managed care beneficiaries from other, non-Medicaid managed care plan enrollees, CMS proposed to require Medicaid-specific Bank Identification Number (BIN), Processor Control Number (PCN), and group number identifiers to be assigned and exclusively used on Medicaid-enrollee pharmacy identification cards where a Medicaid managed plan (described in the preamble as a Medicaid managed care organization (MCO), prepaid inpatient health plan (PIHP), or prepaid ambulatory health plan (PAHP)) includes coverage of CODs. CMS believes that these proposals would help ensure appropriate cost-sharing for Medicaid beneficiaries and help avoid 340B duplicate discounts.

  • What changed? CMS finalized the requirement, with a revision to require a unique BIN and PCN “combination,” along with the group number identifier, to be used on Medicaid-enrollee pharmacy identification cards where a Medicaid managed care plan includes coverage of CODs. CMS also revised the effective date of this provision, such that it will be effective for the first rating period for contracts with managed care plans beginning on or after November 19, 2025 (rather than upon the effective date of the larger rule). CMS noted that, “[w]hile the use of Medicaid-specific BIN, PCN, and group number identifiers does not assist in identifying claims for drugs purchased under the 340B Drug Pricing Program (340B Program), it may help States and their managed care plans avoid invoicing for rebates on 340B drugs by identifying which plans are covered under Medicaid.”

• Requiring PBMs to itemize costs for Medicaid managed care plans.

  • Proposed Rule: CMS proposed to require Medicaid managed care plans (defined above), that cover CODs “to structure any contract with any subcontractor [(e.g., PBM)] for the delivery or administration of the COD benefit [to] require the subcontractor to report separately the amounts related to the incurred claims,” including amounts related to “reimbursement for . . . CODs, payments for other patient services, and the dispensing or administering providers fees, and subcontractor administrative fees.” CMS believes this information would improve the calculation and reporting of the Medicaid Loss Ratio and would also require PBMs to report to plans on the spread between reimbursement paid to pharmacies and amounts charged to Medicaid managed care plans.

  • What changed? CMS finalized this provision without substantive change. This provision will be effective for the first rating period for contracts with Medicaid managed care plans beginning on or after November 19, 2025.

Additional Requirements

• Reporting and invoicing of rebates for physician-administered drugs.

  • Proposed Rule: CMS proposed to “require States to collect NDC information on all covered outpatient single and multiple source physician-administered drugs and to specify that States should be invoicing for rebates for all covered outpatient physician-administered drugs to receive FFP and secure manufacturer rebates” (emphasis added). This would expand upon the requirement in the MDRP statute that requires CMS to condition FFP on states collecting NDC data on certain CMS-specified physician-administered drugs, including single source drugs, and the twenty physician-administered multiple source drugs that the Secretary determines have the highest dollar volume. States were already required to do this for single source physician administered drugs, and for the top 20 high dollar volume multiple source drugs. This expanded obligation could increase significantly the prospective (and likely retrospective) volume of rebate utilization invoiced for multiple source drugs that have not historically been included in CMS’s top 20 list.

  • What changed? CMS finalized this requirement with technical edits to the regulation text but no substantive change. Manufacturers of physician-administered multiple source drugs that have not been historically subject to Medicaid rebates should evaluate potential financial implications of this change.

• Professional dispensing fees and drug ingredient costs.

  • Proposed Rule: CMS proposed that state Medicaid assessments of professional dispensing fees to pharmacy providers, which are paid in addition to reimbursement for pharmacy ingredient costs, “must be based on pharmacy cost data, and . . . cannot be solely determined or supported by a market-based review or by an assessment or comparison of what other payers may reimburse pharmacies for dispensing prescriptions.” In addition, if a state seeks to change the amount by which it reimburses pharmacy providers for drug ingredient costs, those changes not only “must be consistent with [actual acquisition costs], [but] States must support determinations or proposed changes . . . with adequate cost based data.” Such changes would be implemented through State Plan Amendments.

  • What changed? CMS finalized this requirement without change. This provision has the potential to affect state Prescription Drug Affordability Board mandates to impose upper payment limits on state Medicaid programs.

• Payment of claims for pediatric preventive services where there is third-party liability.

  • Proposed Rule: CMS proposed to modify the requirement that state Medicaid agencies must first pay claims in full, and then seek recovery from a third party where the claim is for preventive pediatric services (including Early and Periodic Screening, Diagnostic, and Treatment services) to specify that such claims need be paid in full only if (1) the claim is not paid by the third party within 90 days after the provider submitted the claim, (2) doing so is cost-effective, and (3) doing so will not adversely affect access to services. CMS stated that this change is a correction to the regulation to align with the Bipartisan Budget Act of 2018.

  • What changed? CMS finalized this requirement without change.

Key Proposals That Were Not Finalized

As impactful as the finalized provisions are to MDRP stakeholders, the Final Rule is as notable for the proposals that CMS did not finalize. As noted above, CMS did not finalize its proposal to define “manufacturer” broadly to essentially include all associated entities under common ownership or control. Similarly, CMS did not finalize a proposed definition of “vaccine” or a sweeping proposed drug price verification survey. However, CMS did not rule out revisiting these issues in the future, noting with respect to each of those topics that CMS is “continuing to review the input provided by commenters, which may inform future rulemaking.” Further, CMS proposed to require so-called “stacking” of price concessions to unrelated entities in the supply chain. While, as previously announced, CMS did not finalize this highly controversial proposal, CMS left the door open to revisit this issue, stating that it intends “to pursue the collection of additional information from manufacturers related to best price stacking methodologies to inform future rulemaking.” CMS adds that “[t]he information collection would be intended to ascertain whether a manufacturer implements any form of stacking and, if so, how that stacking is performed.”

Finally, CMS requested comment in the Proposed Rule on the issues, benefits, and challenges of requiring a diagnosis code to be included on a Medicaid prescription, explaining that doing so could help determine whether the prescription is for a medically accepted indication, or qualifies as a COD, and could help states determine whether the prescription is eligible for enhanced federal matching funds, among other potential benefits. In the Final Rule, CMS indicates that it will “continue to review the feedback . . . receive[d] from interested parties and may address this issue in future rulemaking if appropriate.”

*           *           *           *           *

As always, it is important that you carefully review the Final Rule in light of considerations that may be relevant to your organization and specific drugs. Please feel free to contact the Hogan Lovells Health Team if you have any questions or concerns.

Authored by Alice Valder Curran, Ken Choe, Kathleen Peterson, Samantha D. Marshall, Mahmud Brifkani, Rianna Modi, Breanna Reeves, Caroline Farrington, Drew Savage, and Xochitl Halaby.