CMS issues proposed rule implementing CAA Medicare provisions

On October 16, 2026, the Centers for Medicare & Medicaid Services (CMS) released a proposed rule that would implement three sections of the Consolidated Appropriations Act of 2026 (CAA): Section 6220 (Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act), Section 6224 (Modernizing and Ensuring Pharmacy Benefit Manager (PBM) Accountability), and Section 6219 (Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals).

If finalized, the proposed changes would largely apply to plan year 2028 and beyond for Medicare Advantage (MA) and Part D. The proposed rule is open for public comment until December 15, 2026.

This proposed rule is separate from CMS’s annual rulemaking process where it proposes substantive and technical changes to MA, Part D, and the Program of All-Inclusive Care for the Elderly. CMS expects to issue another proposed rule addressing policy and technical changes to MA and Part D later this fall.

REAL Health Providers Act

Beginning with plan year 2028, the CAA established new provider directory and accuracy requirements for MA organizations. For example, for each MA plan, the organization must maintain an accurate provider directory on a website that includes information on the provider’s specialty, address, whether the provider is accepting new patients, the provider’s telehealth capabilities, and more. At least once every 90 days, the organization must verify the provider directory information. If the organization is unable to verify provider directory information, the organization must indicate where information may not be updated, and remove providers that are no longer participating in the plan’s network, consistent with the applicable timeframes. If an enrollee relies on provider directory information that is inaccurate, certain cost-sharing protections apply. MA organizations must annually assess the accuracy of the provider directory for each plan and submit a report to the US Department of Health and Human Services (HHS) secretary that includes an information accuracy score.

Existing MA regulations already establish a framework for submitting provider directory information to CMS for online publication, updating the information, and annually attesting to the information’s accuracy. The proposed rule builds on this framework to implement the enhanced REAL Health Providers Act requirements and to streamline the existing and new requirements. In some ways, the proposed rule provides detail beyond what is specified in the CAA. For example, CMS proposes to:

• Add common ownership or control disclosure as a new provider directory data element. This would include information that a network provider, provider group, facility, or supplier is owned or controlled, in whole or in part, directly or indirectly, by the MA organization, its parent organization, subsidiary, or affiliate, or by any entity that is under common ownership or control with the MA organization.
• Implement a weighted scoring methodology for determining the accuracy score. The score would be converted into a letter grade of A through F and would be displayed publicly beginning in 2029.
• Require MA organizations to apply the provider directory cost-sharing protections – without an enrollee request – when the organization knows, or should reasonably know, that the protection applies (e.g., an enrollee references incorrect directory information when requesting an organization determination).

Modernizing and ensuring PBM accountability

For plan years beginning on or after January 1, 2028, the CAA requires Part D sponsor contracts with PBMs to meet certain standards, including that PBMs and their affiliates may not derive any remuneration with respect to services provided on behalf of any entity or individual in connection with the utilization of covered Part D drugs other than bona fide service fees. Rebates, discounts, and other price concessions received by a PBM or its affiliate from manufacturers do not violate the remuneration restriction if they are fully passed through to the Part D sponsor and are compliant with applicable direct and indirect remuneration requirements. Annually, the PBM must submit a detailed report on drug dispensing and cost data to the Part D sponsor and HHS secretary.

The proposed rule would add important details implementing the CAA’s requirements. For example, CMS proposes to:

• Broadly define key terms such as “affiliate,” “intermediary,” “PBM function,” and “related service,” which impact the entities that may be subject to the CAA requirements.
• Further define key phrases related to the bona fide service fee requirement, including defining “fair market value” as the PBM’s cost of the itemized service plus a reasonable markup. CMS would prohibit two additional types of methodologies for calculating bona fide service fees.
• Define “fully passed through” to mean that the Part D sponsor must receive 100% of the gross economic value of each rebate, discount, or other price concession attributable to covered Part D drug utilization.
• Establish a two-part process for CMS to collect the information necessary to evaluate whether remuneration arrangements are consistent with fair market value.

Adjustments to Medicare Part D cost-sharing reductions for low-income individuals

The CAA modified Part D prescription drug cost sharing for noninstitutionalized, full-benefit dual-eligible individuals whose incomes do not exceed 100% of the federal poverty level. For plan years before 2028, generic drug copayments are subject to a $1 statutory limit, adjusted annually for inflation. For plan year 2028 and beyond, the CAA requires that generic drug copayments for these individuals be reduced to $0.

The proposed rule would implement this statutory requirement, effective for plan years beginning on January 1, 2028. CMS did not propose any further policy changes.

While the proposed rule largely makes conforming changes to implement the CAA’s adjustments to Medicare Part D cost-sharing reductions for low-income individuals, the proposed rule introduces new and meaningful details related to provider directory accuracy and PBM accountability. If finalized, these changes would affect MA organizations, Part D sponsors, and PBMs, mostly beginning in plan year 2028. Comments are due December 15, 2026.