(a) General requirement. An issuer of a reinsurance-eligible plan may make a request for payment when that issuer's claims costs for an enrollee of that reinsurance-eligible plan has met the criteria for reinsurance payment set forth in subpart B of this part and the HHS notice of benefit and payment parameters and State notice of benefit and payment parameters for the applicable benefit year, if applicable.
(b) Manner of request. An issuer of a reinsurance-eligible plan must make requests for payment in accordance with the requirements of the annual HHS notice of benefit and payment parameters for the applicable benefit year or the State notice of benefit and payment parameters described in subpart B of this part, as applicable.
(c) Maintenance of records. An issuer of a reinsurance-eligible plan must maintain documents and records, whether paper, electronic, or in other media, sufficient to substantiate the requests for reinsurance payments made pursuant to this section for a period of at least 10 years, and must make those documents and records available upon request from HHS, the OIG, the Comptroller General, or their designees, or, in a State where the State is operating reinsurance, the State or its designee, to any such entity, for purposes of verification, investigation, audit, or other review of reinsurance payment requests.
(d) Audits and compliance reviews. HHS or its designee may audit or conduct a compliance review of an issuer of a reinsurance-eligible plan to assess its compliance with the applicable requirements of this subpart and subpart H of this part. Compliance reviews conducted under this section will follow the standards set forth in § 156.715 of this subchapter.
(1) Notice of audit. HHS will provide at least 30 calendar days advance notice of its intent to conduct an audit of an issuer of a reinsurance-eligible plan.
(i) Conferences. All audits will include an entrance conference at which the scope of the audit will be presented and an exit conference at which the initial audit findings will be discussed.
(ii) [Reserved]
(2) Compliance with audit activities. To comply with an audit under this section, the issuer must:
(i) Ensure that its relevant employees, agents, contractors, subcontractors, downstream entities, and delegated entities cooperate with any audit or compliance review under this section;
(ii) Submit complete and accurate data to HHS or its designees that is necessary to complete the audit, in the format and manner specified by HHS, no later than 30 calendar days after the initial audit response deadline established by HHS at the entrance conference described in paragraph (d)(1)(i) of this section for the applicable benefit year;
(iii) Respond to all audit notices, letters, and inquiries, including requests for supplemental or supporting information, as requested by HHS, no later than 15 calendar days after the date of the notice, letter, request, or inquiry; and
(iv) In circumstances in which an issuer cannot provide the requested data or response to HHS within the timeframes under paragraph (d)(2)(ii) or (iii) of this section, as applicable, the issuer may make a written request for an extension to HHS. The extension request must be submitted within the timeframe established under paragraph (d)(2)(ii) or (iii) of this section, as applicable, and must detail the reason for the extension request and the good cause in support of the request. If the extension is granted, the issuer must respond within the timeframe specified in HHS's notice granting the extension of time.
(3) Preliminary audit findings. HHS will share its preliminary audit findings with the issuer, who will then have 30 calendar days to respond to such findings in the format and manner specified by HHS.
(i) If the issuer does not dispute or otherwise respond to the preliminary findings, the audit findings will become final.
(ii) If the issuer responds and disputes the preliminary findings, HHS will review and consider such response and finalize the audit findings after such review.
(4) Final audit findings. If an audit results in the inclusion of a finding in the final audit report, the issuer must comply with the actions set forth in the final audit report in the manner and timeframe established by HHS, and the issuer must complete all of the following:
(i) Within 45 calendar days of the issuance of the final audit report, provide a written corrective action plan to HHS for approval.
(ii) Implement that plan.
(iii) Provide to HHS written documentation of the corrective actions once taken.
(5) Failure to comply with audit activities. If an issuer fails to comply with the audit activities set forth in this subsection in the manner and timeframes specified by HHS:
(i) HHS will notify the issuer of reinsurance payments received that the issuer has not adequately substantiated; and
(ii) HHS will notify the issuer that HHS may recoup any payments identified in paragraph (5)(i) of this section.
[77 FR 17248, Mar. 23, 2012, as amended at 78 FR 15530, Mar. 11, 2013; 78 FR 65094, Oct. 30, 2013; 79 FR 13835, Mar. 11, 2014; 86 FR 24286, May 5, 2021]