On July 15, 2025, the Centers for Medicare & Medicaid Services (CMS) released an Audit and Enforcement Report summarizing its annual Medicare Advantage (Part C) and Prescription Drug (Part D) program audits and enforcement actions in 2024. The report underscores CMS’s focus on particular federal requirements for the Part C and Part D programs—including utilization management, coverage determinations, and effective compliance programs—and outlines the agency’s imposition of sanctions for non-compliance. Insurers that offer Medicare Advantage, prescription drug, and Medicare Medicaid plans should continue to maintain effective internal auditing, monitoring, and compliance systems.
Background
CMS regularly conducts program audits of organizations it contracts with to administer Medicare benefits. In 2024, CMS conducted 39 program audits of 36 parent organizations—referred to in the report as “sponsors”—that offer Medicare Advantage, prescription drug, and Medicare Medicaid plans. Of those audits, 19 were routine and comprehensive, while the remaining 20 audits were targeted at certain program areas. In total, 2024 program audits covered 494 contracts that served 87.6% of Medicare Part C enrollees and 68.8% of enrollees in Medicare Parts C and D together.
CMS evaluated compliance in seven total program areas based on the contract types offered by the audited sponsors. At a high level, CMS assessed the effectiveness of sponsors’ compliance programs and reviewed samples of coverage requests and claims to determine if they were accurately and timely processed. In addition, CMS evaluated whether health risk assessments were timely completed and incorporated into individualized care plans for enrollees. The report details certain areas of non-compliance and provides guidance and lessons learned for more robust compliance.
Areas of Non-Compliance
Based on its audits, CMS identified non-compliance in the following program areas:
- Ineffective Compliance Programs for Delegated Entities: CMS determined that certain sponsors did not track, address, and correct compliance issues related to functions performed on the plan’s behalf by subcontractors and vendors called “delegated entities” and recommended that sponsors implement routine monitoring to ensure effective oversight of delegated entities.
- Improper Limitations on Access to Medications: CMS found that sponsors limited access to covered Part D medications on their formulary by applying improper dosage and quantity restrictions and failing to provide temporary allowances to eligible beneficiaries whose use of medications was interrupted. CMS recommended that sponsors consider removing dosage and quantity restrictions where formulary criteria do not change for different strengths or doses.
- Erroneous and Delayed Coverage Determinations: CMS identified Part C and Part D coverage requests that were misclassified or improperly dismissed because of insufficient internal processes. As a result, beneficiaries experienced delays in receiving coverage or accessing medications. CMS recommended that sponsors set up appropriate safeguards to ensure proper processing of coverage requests, including those submitted through electronic systems and call centers.
- Lack of Clarity in Decision Notifications: CMS found that certain sponsors did not clearly communicate an adverse coverage determination or specify a beneficiary’s rights when challenging the decision, which prevented beneficiaries or their providers from appropriately advocating for services.
- Failure to Incorporate Health Risk Assessments: Medicare Advantage plans and Medicare-Medicaid plans are expected to make best efforts to conduct a health risk assessment for beneficiaries within 90 days of enrollment. That assessment is then used to formulate an individualized care plan for each beneficiary. CMS found that certain individualized care plans did not fully incorporate the results from enrollees’ health risk assessments. CMS recommended that sponsors consider all results from a beneficiary’s health risk assessment when developing an individualized care plan.
CMS’s Focus on Utilization Management
Utilization management (UM) has been an area of regulatory focus and media scrutiny in the Part C and Part D programs.1 In April 2023, CMS issued a final rule that introduced new UM requirements to Medicare programs intended to ensure timely access to care.2 Medicare Advantage organizations were expected to implement the UM requirements by January 1, 2024, and CMS assessed compliance with these requirements for the first time in its 2024 audits. Despite heightened scrutiny of this area, CMS did not identify any significant non-compliance and found that organizations “were working to implement these new requirements.”3
However, one noteworthy aspect of CMS’s report is its discussion of prior authorization, a tool that requires enrollees to obtain advance approval for coverage of certain medical items or services, including prescription medications. The report assessed whether Medicare Advantage organizations “[d]enied a service based on lack of medical necessity when it previously approved the service through prior authorization.”4 For prescription medications, for example, CMS recommended that where a prior authorization requirement is the same for all doses of the medication, sponsors should not limit the authorization to a specific dosage. Prior authorization will likely continue to be an area of regulatory focus for CMS.
CMS’s Enforcement Through Civil Monetary Penalties
CMS audits can lead to enforcement or contract actions resulting in civil money penalties (CMP).5 The agency has authority to take actions against a sponsor that violates Medicare Part C and Part D program requirements and reviews audit findings to determine if a violation has occurred that warrants a CMP.6
Based on its 2024 audits, CMS imposed CMPs on 14 sponsors for 18 different violations. CMS determines the CMP amount based on various factors, such as the number of affected enrollees and nature and scope of the violations. CMS may also increase the CMP amount if it determines that certain aggravating factors are present, such as whether violations involved drugs for acute conditions that require immediate treatment, whether an enrollee was inappropriately denied medical services or medications, or whether a sponsor has a prior offense. Out of the 18 violations CMS found, 16 had an aggravating penalty.
The majority of the CMPs were for inappropriate cost sharing for Part C services and Part D medications. This category included the largest penalty—$2 million for allegedly failing to comply with Part C’s maximum out-of-pocket requirement. CMS regulations require Medicare Advantage plans to cap in-network and out-of-pocket expenses for basic benefits at an amount no greater than the annual limit calculated by CMS. Plans must track this out-of-pocket spending and alert enrollees and providers when the plan’s maximum out-of-pocket amounts are reached, and plans are prohibited from further charging an enrollee. CMS determined that a sponsor violated these provisions by failing to track enrollees’ out-of-pocket spending and charging enrollees more than annual out-of-pocket limits.
CMS also imposed CMPs for sponsors that inappropriately denied or delayed the release of Part D medications to enrollees or misclassified Part D coverage requests. The largest CMP in this category was for a sponsor that inappropriately rejected enrollees’ access to medications due to errors with eligibility files sent to the sponsor’s pharmacy benefit manager, which then improperly voided enrollees’ coverage and rejected claims as “coverage terminated.” As a result, enrollees experienced delays in getting their medication, had to pay for it out of pocket, or never received it.7
The CMPs imposed by CMS were the result of many internal system-wide failures, including the failure to update eligibility profiles or accurately track out-of-pocket limits. CMS requires that sponsors maintain effective oversight of their claims processing systems through routine monitoring, regular system updates, configuration testing, and proper benefit design implementation. Sponsors should ensure adequate compliance with CMS regulations by putting in place robust compliance and oversight systems and updating those systems periodically. Where a beneficiary is overcharged, sponsors should have effective systems in place to ensure that these beneficiaries are refunded. Failure to do so will likely result in enforcement actions and substantial penalties.
Footnotes
