CMS Issues the Long-Awaited Medicaid Drug Rebate Program Final Rule, with Fewer Changes than Anticipated

I. Introduction

On September 20, 2024, the Centers for Medicare & Medicaid Services (“CMS”) issued a long-awaited final rule titled “Medicaid Program; Misclassification of Drugs, Program Integrity Updates Under the Medicaid Drug Rebate Program (“MDRP”)” (the “Final Rule”).¹ In issuing the Final Rule, CMS declined to finalize some of the most controversial parts of its May 2023 proposed rule (the “Proposed Rule”),² such as Best Price stacking, a drug pricing survey, or defining the term “manufacturer.” In a prior Alert, we summarized key provisions of the Proposed Rule.

The Final Rule nonetheless adopts other significant changes to the MDRP that may alter manufacturers’ rebate obligations and raise the stakes around strict MDRP reporting compliance. The effective date of the finalized regulations is in a few weeks, on November 19, 2024, although certain provisions relating to managed care programs have delayed effective dates, as explained below.

Key provisions of the Final Rule are summarized below.

II. Drug Misclassification in the MDRP

a. Background

Under the MDRP, participating manufacturers enter into a National Drug Rebate Agreement (“NDRA”) with the Secretary of the U.S. Department of Health and Human Services (“HHS”) in exchange for state Medicaid coverage of their covered outpatient drugs (“CODs”). Under an NDRA, manufacturers must pay rebates to states to help partially offset the federal and state costs of the CODs dispensed and paid for under state Medicaid plans. Under the MDRP, manufacturers must report and certify to CMS certain drug product and drug pricing information for CODs to support the calculation and assessment of rebates.

CMS has previously expressed its belief that many manufacturers misreport drugs, for example by reporting single source drugs (“S drugs”) or innovator multiple source drugs (“I drugs”) as noninnovator drugs (“N drugs”) or by paying rebate amounts that are not supported by the drug’s classification. The Medicaid Services Investment and Accountability Act of April 2019 (“MSIAA”) included a section titled “Preventing the Misclassification of Drugs Under the [MDRP],” which, among other amendments, delegated compliance, oversight, and enforcement authorities to HHS to oversee manufacturers’ reporting obligations under the MDRP. Through the Final Rule, CMS codifies the statutory amendments of the MSIAA, and further explains to manufacturers the agency’s intentions in enforcing drug misclassification and incorrect reporting under the MDRP.

b. Identification and Notification to Manufacturer to Correct Misclassification

CMS adopted new misclassification provisions that have few changes from the provisions contemplated in the Proposed Rule. In the Final Rule, CMS defines misclassification in the MDRP as occurring when “a manufacturer has: (i) [r]eported and certified to the agency its drug category or drug product information related to a [COD] that is not supported by the statute and applicable regulations; or, (ii) [r]eported and certified to the agency its drug category or drug product information that is supported by the statute and applicable regulations, but pays rebates to the States at a level other than that associated with that classification.” CMS emphasizes that the implementing statute expressly indicates that “a drug misclassification can occur without regard to whether the manufacturer knowingly made the misclassification or should have known that the misclassification was made.”³

As an example, CMS says that a COD is considered misclassified if it is reported to CMS as an N drug when, according to CMS as based on its application of relevant statutes and regulations, the COD should be classified as an S drug. CMS expressly applies its authority under the misclassification provisions to the narrow exception context, stating that CMS would be able to pursue penalties against manufacturers that do not change their drug classification when their narrow exception request has been denied by CMS.

Furthermore, misclassification is not limited to drug category but applies to any incorrectly used “drug product information” relating to a COD. CMS adopted a definition of “drug product information” that includes “National Drug Code (NDC), drug name, units per package size (UPPS), drug category (“S”, “I”, “N”), unit type (for example, TAB, CAP, ML, EA), drug type (prescription, over-the-counter), base date [average manufacturer price (“AMP”)], therapeutic equivalent code (TEC), line extension indicator, 5i indicator and route of administration (if applicable), [U.S. Food and Drug Administration (“FDA”)] approval date, FDA application number or OTC monograph citation (if applicable), market date, and COD status.” CMS declined to include its proposed catch-all to the definition of drug product information: “any other information deemed necessary by the agency to perform accurate unit rebate amount (URA)⁴ calculations.” Taken together, the scope of agency-defined misclassification is expansive—any incorrectly used drug product information could trigger enforcement and potential penalties under the misclassification provisions.

CMS also sets forth a process for notifying manufacturers of a drug misclassification and requiring remediation. Under the Final Rule, after determining that a misclassification has occurred, CMS “will send written and electronic notification of [the] misclassification to the manufacturer of the [COD], which may include a notification that past rebates are due.” From the date of notification, the manufacturer will be allotted 30 calendar days to “provide [CMS] with [any] drug product and drug product information needed to correct the misclassification of the [COD] and calculate rebate obligations [that are] due” for the rebate periods during which the misclassification occurred. During this 30-day time period, the manufacturer also must certify the applicable price and drug product data provided to CMS.

c. Manufacturer Payment of Unpaid Rebates Due to Misclassification

CMS also sets out a process for manufacturers to pay unpaid rebates to the state for misclassified drugs after identification by CMS and notification of the manufacturer. Specifically, a manufacturer must pay each state, for each period during which the drug was misclassified, the difference between (i) the per URA paid by the manufacturer for the COD when the COD was misclassified and (ii) the per URA that the manufacturer would have paid if the COD were classified correctly, multiplied by the total units of the COD paid for under the state Medicaid plan in each period. Manufacturers must pay the unpaid rebates within 60 calendar days from the notice from CMS to the manufacturer indicating that a COD is misclassified. Within this same time frame, manufacturers must provide documentation to CMS confirming that all past-due rebates have been paid.

d. Agency Authority to Correct Misclassifications and Additional Penalties for Drug Misclassification

CMS adopted a set of enforcement measures that it may use in the event that a manufacturer fails to (i) correct the misclassification within 30 calendar days from the date of notification, (ii) certify applicable pricing and drug product data, and/or (iii) pay any unpaid rebates that are due as a result of the misclassification within 60 calendar days from the date of notification. Specifically, if a manufacturer fails to correct the misclassification within 30 calendar days from the date of notification, then CMS may correct the misclassification of the drug in the system on behalf of the manufacturer, using any pricing and drug product information that may have been provided by the manufacturer. In such case, the manufacturer must certify the applicable correction within 30 calendar days. CMS says it may take other actions in response to any of the failures described above, including (i) suspending the misclassified drug and the drug’s status as a COD under the manufacturer’s NDRA, (ii) excluding the misclassified drug from Federal Financial Participation (“FFP”) pursuant to section 1903(i)(10)(E) of the Act, and/or (iii) imposing a civil monetary penalty for each rebate period during which the drug is misclassified, up to a maximum cap, equal to the total number of units of each dosage form and strength of the misclassified drug paid for under any State plan during such a rebate period multiplied by 23.1% of the AMP for the dosage form and strength of such misclassified drug for that period. In addition to these actions expressly outlined in the Final Rule, CMS may take other actions or seek additional penalties available under any other provision of law, including referral to the HHS Office for Inspector General and termination from the MDRP.

e. Reporting Manufacturer Misclassification

Finally, in furtherance of a statutory provision, the Final Rule authorizes CMS to make publicly available an annual report listing the CODs that were identified as misclassified during the previous year, with accompanying information relating to any steps taken by CMS to reclassify the CODs and ensure manufacturers paid any additional rebate amounts due as a result of the misclassification.

III. Definitional Changes

In the Final Rule, CMS updated components of the covered outpatient drug definition, and finalized definitions of market date, internal investigation, and noninnovator multiple source drug.

• Covered Outpatient Drug: The statutory definition of COD “does not include any drug, biological product, or insulin provided as part of or incident to and in the same setting as any of [a list of services set forth in the regulation] (and for which payment may be made as part of that service instead of as a direct reimbursement for the drug).”⁵ Historically, this provision has been understood to foreclose rebates where payment for a drug is “bundled” with payment for a service. The Final Rule changes course and defines “direct reimbursement” as “includ[ing] both (i) reimbursement for a drug alone or (ii) reimbursement for a drug plus the service, in a single inclusive payment if: (A) the drug, charge for the drug, and number of units of the drug are separately identified on the claim; and; (B) the inclusive payment includes an amount directly attributable to the drug; and, (C) the amount paid that is attributable to the drug is based on a reimbursement methodology that is included in the applicable section of the State plan.”
• Market Date: CMS adopted a definition of market date that reflects the date on which the COD was first sold by any manufacturer. CMS declined to adopt a definition for the term “sold”—though it proposed and requested comments on such a definition—and stated that it “will permit manufacturers to use reasonable assumptions as to the date a sale has occurred.”
• Internal Investigation: Under the Social Security Act, manufacturers generally have a 12-quarter window to make restatements, except in defined circumstances, which include restatements as a result of an internal investigation. CMS had proposed to define “internal investigation” as CMS proposes to define an internal investigation as a manufacturer investigation of pricing or other previously certified data that “results in a finding made by the manufacturer of fraud, abuse, or violation of law or regulation.” The Final Rule adopts a definition of internal investigation that clarifies that a manufacturer need not have found a violation of law or regulation in order to make a restatement. Instead, CMS says that an “internal investigation” refers to “a manufacturer’s investigation of its AMP, best price, customary prompt pay discounts, or nominal prices that have been previously certified in the [MDRP] that results in a finding made by the manufacturer of possible fraud, abuse, or violation of law or regulation.”⁶ CMS explains that it intends for this rule to allow for revisions to previously reported data in the context of acquired drugs, where an acquiring manufacturer finds, and appropriately substantiates, a violation of statute or regulation by the prior manufacturer. Under the Final Rule, mere disagreement with the prior manufacturer’s pricing calculations would not be a legitimate justification for an exception to the 12-quarter rule.
• Noninnovator Multiple Source Drug: In the Final Rule, CMS amended the definition of a noninnovator multiple source drug, or N drug, such that an N drug is “a [COD] that entered the market before 1962 that is not marketed under an NDA.”

IV. Other Changes

• 12-Quarter Rebate Audit Time Limitation: While there are currently no time limits for a manufacturer’s initiation of an audit or resolution of state utilization data, in the Final Rule, CMS limited the time period for manufacturer-initiated disputes and audits to “12 quarters from the last day of the quarter from the State invoice postmark date.” Multiple commenters questioned CMS’s authority to limit the timeframe for manufacturer audits, given that there is no such express time limitation under the MDRP statute. CMS responded that it believes that Section 1902(a)(4) of the Social Security Act⁷—which authorizes the Secretary to specify methods of administration found to be necessary for proper and efficient administration of the MDRP—grants CMS the authority to impose such a time limit on manufacturers.
• Beneficiary Identification Number and Processor Control Number (“BIN/PCN”) on Medicaid Managed Care Cards: CMS adopted a requirement for Medicaid managed care organizations (“MCOs”), prepaid inpatient health plans (“PHIPs”), and prepaid ambulatory health plans (“PAHPs”) that provide coverage of CODs to assign and exclusively use unique Medicaid BIN/PCN combination and group number identifiers for all Medicaid managed care beneficiary identification cards for pharmacy benefits. CMS believes that the Final Rule will help mitigate the risk of duplicate discounts under the 340B program by allowing for easier identification of Medicaid managed care claims. In response to comments requesting more time to implement this change, CMS finalized the applicability date for this provision to be the first rating period for contracts with managed care plans beginning on or after November 19, 2025 (i.e., one year following the effective date of the Final Rule, which is November 19, 2024).
• Drug Cost Transparency in Medicaid Managed Care Contracts: Many MCOs, PHIPs, and PAHPs contract with subcontractors, such as pharmacy benefit managers (“PBMs”), to administer the Medicaid drug benefit. Currently, CMS does not require disclosure of the amount of “spread pricing,” or the difference between the amount a PBM charges a managed care plan for a drug claim and the amount paid by a PBM to a pharmacy for the claim. To increase transparency and accountability related to the payment for CODs, CMS adopted, as proposed, the requirement that subcontractors of managed care plans report separately certain expenses and costs above the actual cost of the prescription drug and dispensing fee. CMS finalized the applicability date for the spread pricing disclosure requirement to be the first rating period for contracts with managed care plans beginning on or after November 19, 2025.
• Conforming Changes to Best Price and AMP Patient Assistance Program Provisions: Consistent with the U.S. District Court for the District of Columbia’s decision in Pharmaceutical Research and Manufacturers of America vs. Becerra,⁸ which vacated and set aside regulations promulgated by CMS in 2020 that would have required manufacturers to “ensure” that the full value of patient assistance programs are passed on to the consumer, CMS adopted its proposal to withdraw this requirement as related to both AMP and best price regulations, effectively reverting the regulation to its form in 2016.
• Suspension of Manufacturer NDRA for Late Reporting of Pricing and Drug Product Information: CMS adopted, as proposed, the process by which a manufacturer’s NDRA would be suspended for a minimum of 30 calendar days in the event of a continued failure to report drug pricing or drug product information to CMS after 90 calendar days from the date on which CMS provides written notice to the manufacturer of delinquent reporting. If suspended, a manufacturer’s CODs would no longer be eligible for Medicaid coverage or reimbursement and Medicaid FFP, and the suspension would continue for as long as the drug pricing or drug product information is not reported in full and certified. The final regulations state that continued suspension could result in termination for cause and says that suspension “does not affect manufacturer obligations and responsibilities under the 340B Program or reimbursement under Medicare Part B.”
• Conforming Changes to Remove Rebate Cap: In accordance with section 9816 of the American Rescue Plan Act of 2021, which sunsetted the limit on maximum rebate amounts or single source and innovator multiple source drugs, CMS amended the MDRP regulations to remove the limit or “100% AMP cap,” effective as of January 1, 2024.
• Conditions Relating to Physician-Administered Drugs: The Final Rule requires states to collect NDC information on all covered outpatient single and multiple source physician-administered drugs—a significant jump from the current requirement to collect information on the “top 20 high dollar volume physician-administered drug[s].” The Final Rule further requires that states invoice rebates for all such drugs.

V. Proposed Changes Not Adopted

• “Stacking” for the Determination of Best Price: In the Proposed Rule, CMS proposed to modify the determination of Medicaid “best price” by requiring manufacturers to “stack” all price concessions to determine the final price realized by the manufacturer for a drug. For example, CMS proposed that if a manufacturer were to offer multiple discounts to two different entities in the distribution chain in connection with a particular unit of a drug, all the discounts would be aggregated to determine the drug’s best price. This proposal was one of the most contentious components of the Proposed Rule, with multiple stakeholders disputing CMS’s legal authority to adopt such a provision. On May 15, 2024, CMS issued a press release stating that it would not finalize the proposed best price stacking regulations and would continue to evaluate stacking methodologies in future rulemaking.⁹
• Drug Price Verification Survey Process: CMS proposed to implement a process by which CMS could survey manufacturers and wholesalers to verify reported prices under the MDRP. After reviewing comments, CMS declined to finalize this proposed policy in the Final Rule.
• Request for Information on Requiring a Diagnosis on Medicaid Prescriptions: In the Proposed Rule, CMS sought feedback on the potential impact of requiring that a patient’s diagnosis be included on a prescription as a condition of receiving Medicaid FFP for that prescription. After considering comments, CMS declined to promulgate rules on this topic.
• Definitions Not Finalized: CMS declined to finalize definitions of the terms manufacturer and vaccine. Instead, the agency has stated that it will continue to review public comments, which may inform future rulemaking on these definitions.

If you have any questions regarding the Final Rule, please do not hesitate to contact one of the authors or your regular Ropes & Gray advisor.