CMS Final Medicaid Drug Rebate Rule Details New Misclassification Penalties and Numerous Other Changes

In May 2023, we posted about a CMS proposed regulation that sought to make a wide variety of changes to the Medicaid Drug Rebate Program (MDRP), including a new “price verification survey,” and a controversial proposal to require “stacking” of discounts to different customers when determining best price.  Fortunately, in the final regulation, which was published in the Federal Register on Thursday, September 26, CMS decided not to finalize some of the more objectionable proposals – a good illustration of the usefulness of submitting comments on proposed regulations.

CMS did not finalize the price verification survey, which would have required manufacturers of 10 costly drugs selected annually to provide clinical information as well as information on production, distribution, research, and marketing costs, revenue and profit, and ex-U.S. pricing, among other things.  CMS also decided to forego its best price stacking proposal, which has been the subject of litigation, though CMS is instead going to pursue a “collection of additional information from manufacturers related to best price stacking methodologies to inform future rulemaking.”  In addition, CMS is not going to finalize an “all-in” definition of “manufacturer,” which would have required that a manufacturer and all of its affiliates, subsidiaries, business segments, and entities under common corporate ownership or control each maintain a National Drug Rebate Agreement (NDRA), with the threat of termination of all of the manufacturer’s agreements if this requirement were violated.  Another rejected proposal was a definition of “vaccine” (vaccines are exempt from Medicaid rebates), which would have limited this term to a product that is administered prophylactically – i.e., to prevent rather than treat a disease. Yet another rejection was a proposal requiring a diagnosis on Medicaid prescriptions as a condition for claims payment.

Despite the removal of some of the most controversial proposals, the final rule still contains a variety of significant changes, which become effective on November 19, 2024.  The most noteworthy are the following:

1.  Penalties for “Misclassification”

The Medicaid Services Investment and Accountability Act of 2019 added new penalties to the Medicaid rebate statute for knowingly misclassifying a covered outpatient drug.  See 42 U.S.C. § 1396r-8(b)(3)(C)(iii).  CMS’ final regulation expansively defines a “misclassification” to include not only misclassifying the drug category (e.g., misclassifying a single source drug or innovator multiple source drug as a non-innovator multiple source drug), but also reporting other “drug product information . . . that is not supported by the statute and applicable regulations.”  The term “drug product information” is now defined to include NDC, drug name, units per package size (UPPS), drug category (S, I, or N), unit type (e.g., TAB, CAP, ML, EA), drug type (prescription or OTC), base date AMP, therapeutic equivalent code, line extension indicator, 5i indicator, 5i route of administration (if applicable), FDA approval date, FDA application number or OTC monograph citation (if applicable), market date, and covered outpatient drug status.  In response to comments, the catch-all phrase “any other information CMS deems necessary” was deleted from this list.  A misclassification also includes correctly reporting drug product information, but paying rebates at a level not corresponding with that classification.  A misclassification can occur even if it was not a knowing error.

The regulation sets forth a process under which CMS may notify a manufacturer in writing about a misclassification, after which the manufacturer must (1) report and certify corrected product information in the Medicaid Drug Programs (MDP) system within 30 calendar days after the CMS notice; and (2) pay any underpaid rebates to states and provide documentation to CMS that such payments were made, both withing 60 calendar days after the CMS notice.  Remarkably, manufacturers may not dispute a CMS notification.  CMS specifically declined to provide a dispute resolution process, inconsistently explaining on one hand that the statute does not provide for such a process, but on the other hand stating that CMS will consider a dispute process for future rulemaking.  The preamble notes that the corrections required by a CMS notice may extend back to periods beyond the 10-year recordkeeping requirement under the MDRP.  If a manufacturer no longer has records required to make corrections, it may make “reasonable assumptions.”

With regard to the 30-day deadline for corrections, many manufacturers who have corrected drug product information know that it frequently takes longer than 30 days to investigate and correct information such as base date AMP, market date, or unit type, and revise the other drug data and prices that follow from such corrections – especially if numerous NDCs are involved.  However, CMS rejected requests to extend the 30-day timeframe.  The preamble (but not the rule) does state that a manufacturer may request an informal extension of the 30- and 60-day deadlines if there are extenuating circumstances.

The 60-day deadline for adjusting rebates to the states means that these adjustments will take place outside of the usual quarterly cycle in which rebate adjustments have traditionally been made with the states.

If a manufacturer fails to make corrections or pay rebates within the respective deadlines, CMS may do any or all of the following:

• Unilaterally correct the drug product information, which the manufacturer must certify in MDP within 30 days;
• Suspend the drug in question from the MDRP and deny federal financial participation (FFP; i.e., funding) to states if the drug is dispensed to Medicaid beneficiaries;
• Impose a civil monetary penalty not to exceed 23.1% of the AMP for each unit paid for by Medicaid during the period of misclassification.

If these actions were not enough, a manufacturer’s rebate agreement may be suspended if the information required in a CMS notice is not reported within 90 calendar days, as further explained in section 2, below.

CMS will also post annually on a public web site all of the drugs that were identified as misclassified during the previous year, and any of the above actions taken by CMS.

2.  Rebate Agreement Suspension

The final rule for the first time provides for suspensions of rebate agreements in two circumstances.  The first is where a manufacturer receives a notice of a misclassification described in section 1, above, and fails to correct the drug product information within 90 calendar days.  Second, if a manufacturer fails to submit timely quarterly pricing reports, CMS will notify the manufacturer of the failure.  If the manufacturer fails to submit the required pricing reports within 90 calendar days after the notice, the manufacturer’s rebate agreement will be suspended for all of the manufacturer’s covered outpatient drugs furnished after the end of the 90-day period, and will remain suspended until the pricing information is reported in full to CMS and certified, and CMS reviews it for completeness, but may not be suspended for less than 30 calendar days.  Continued suspension of the rebate agreement may result in termination for cause.  The suspension of a rebate agreement will not affect the status of the manufacturer’s covered outpatient drugs under the 340B Drug Discount Program or under Medicare Part B.

3.  Restatements Pursuant to Internal Investigations

Under the MDRP, manufacturers must restate incorrect AMPs and best prices and may do so without CMS involvement going back three years from the current quarter.  Periods before the three-year window may only be restated pursuant to a request to CMS citing one of the grounds specified in the regulations.  One of the specified grounds for such a request is to address specific rebate adjustments as required “under an internal investigation.”  CMS proposed to define an “internal investigation” as a manufacturer’s investigation of its AMP, best price, customary prompt pay discounts, or nominal prices previously certified to CMS “that results in a finding of fraud, abuse, or a violation of law or regulation.”  In response to manufacturer objections, CMS inserted the word “possible” before “fraud, abuse, or a violation of law or regulation” so that manufacturers would not have to concede legal fault in order to make a restatement beyond three years. However, a restatement request will still concede a “possible” violation of law – even if the error caused an overpayment of rebates to the government’s benefit.  (CMS has previously stated that a restatement may result from an internal investigation that discovered an underpayment or an overpayment of rebates.)  The manufacturer must also “make data available to CMS to support its finding” of a possible violation.  CMS has not typically required manufacturers to submit data supporting a restatement beyond the three-year window, other than submission of change request templates and an estimate of the financial impact (i.e., how much money will be owed to the states or to the manufacturer).  It remains to be seen what additional information CMS will be requesting to support a manufacturer’s finding of possible fraud, abuse, or violation of law.

4.  Other Changes

The final rule contains an assortment of other changes to the MDRP, which include the following:

• “Direct reimbursement” definition: Under the statute, covered outpatient drugs do not include drugs that are used incident to other services (e.g., physicians services or inpatient hospitals services) and for which Medicaid payment may be made as part of payment for the service “and not as direct reimbursement for the drug.”  42 U.S.C. § 1396r-8(k)(3).  Under the final rule, “direct reimbursement for the drug” would not be limited to separate payment for the drug.  It would also occur when there is an all-inclusive payment for the drug and the service, but the drug, the charge for the drug, and the units are specified on the claim, and the inclusive payment includes an amount directly attributable to the drug based on a reimbursement methodology described in the state’s Medicaid state plan.
• Market Date definition: Market Date, which determines the baseline quarter, is defined in the final rule to be “the date on which the covered outpatient drug was first sold by any manufacturer.”  The preamble explains that manufacturers may use reasonable assumptions as to when a sale takes place (e.g., date of payment, date of shipment, date of invoice, etc.).  The preamble also explains that the definition is prospective only, so that manufacturers that determined Market Date in accordance with earlier program instructions that Market Date was the earliest date the drug was available for sale will not be required to change the Market Date to the earliest date sold.
• Three-Year Limit on Disputes: The final rule establishes a three-year limit for manufacturers to dispute, audit, or request a hearing on state utilization data.  The three years runs from the last day of the quarter from the state invoice postmark date.  Commenters had advocated a similar restriction on states seeking to submit rebate utilization, citing certain states that have sent invoices for decades-old utilization.  CMS declined to impose any similar time limit on states, explaining that states have an incentive to resolve disputes promptly because federal law prohibits them from receiving FFP for adjustments beyond two years after a claim for FFP is first filed.  CMS failed to mention that states may request a waiver of the two-year deadline for good cause.  The final rule contains no provision for good-cause waivers of the new three-year limit on disputes.
• PBM Spread Reporting: Pharmacy Benefit Managers (PBMs) have been criticized in recent years for their practice of spread pricing, and Congress has been debating legislation that would prohibit it.  Spread pricing refers to PBMs’ practice of charging their health plan clients a higher price for a unit of dispensed drug than the PBM pays the pharmacy for the unit.  The so-called spread, or margin, is not disclosed by the PBM to their clients, patients, or anyone else.  The final rule, while not prohibiting spread pricing, takes a step toward discouraging it through a new transparency reporting requirement.  Medicaid managed care plans must contractually require their PBMs to separately report to them payments made to providers — such as drug reimbursement, dispensing fees, drug administration fees, and payments for other patient services — and expenses of the PBM itself —  such as administrative costs, fees, and other expenses.
• Codification of URA cap sunset: Under the American Rescue Plan Act of 2021, a provision that capped the Unit Rebate Amount to 100% if the average manufacturer price (AMP) was sunsetted effective December 31, 2023.  The final rule makes conforming changes to the MDRP regulations.  In the preamble, CMS foreclosed any possibility of waiver of inflation rebates for drugs in shortage (similar to waivers provided for under the Medicare Inflation Rebate Programs), explaining that CMS has no such authority under the Medicaid statute.