The Centers for Medicare & Medicaid Services (CMS) has issued a final rule to require Medicare prior authorization (PA) for certain durable medical equipment (DME), prosthetics, orthotics, and supplies (DMEPOS) items that the agency characterizes as “frequently subject to unnecessary utilization.” Notably, however, key policy decisions — including the items that will initially be subject to PA and final timeframes for review of PA requests – still have not been announced. The final rule, published December 30, 2015, specifies a “Master List” of 135 items that will potentially be subject to PA because the item has been (1) identified in a GAO or HHS OIG national report published in 2007 or later as having a high rate of fraud or unnecessary utilization; or (2) listed in the 2011 or later Comprehensive Error Rate Testing (CERT) DME and/or DMEPOS Service Specific Reports, The Master List is further limited to those items with an average purchase fee of at least $1,000 or an average rental fee schedule of at least $100 (adjusted annually for inflation). The Master List will be “self-updating” annually and published in the Federal Register. Items generally will remain on the list for 10 years. The initial Master List is set forth in table 5 of the final rule. Importantly, the presence of an item on the Master List does not automatically mean that PA is required. CMS will select a subset of these Master List items for its “Required Prior Authorization List,” and only those items will be subject to the new PA requirements. According to CMS, establishing PA for a subset of items allows it “to monitor and balance programmatic activity with return on investment while safeguarding program integrity and beneficiary access to care.” CMS has not yet released the Required Prior Authorization list; CMS instead intends to publish it in the Federal Register with a notice period of at least 60 days. In response to commenters who requested a longer period to prepare for PA, CMS committed to “communicating to the community in a variety of ways before posting the 60-day notice,” such as through “Open Door Forum” calls or Medicare Administrative Contractor (MAC) webinars. The final rule does not create new clinical documentation requirements for the selected DMEPOS items. Instead, the same information necessary now to support Medicare payment for the item will be submitted to the MAC, but it will have to be submitted before the item can be furnished to the beneficiary and before the claim can be submitted for payment. Upon receipt of a PA request, CMS or the MAC will determine whether the item complies with applicable coverage, coding, and payment rules, and then communicate a decision that provisionally affirms or non-affirms the request. A claim submitted by a supplier with a non-affirmation decision or without a decision will be denied. The rule allows unlimited resubmissions of PA requests. Claims receiving a provisional affirmation may subsequently be denied based on technical requirements that can only be evaluated after the claim has been submitted for formal processing (e.g., a duplicate claim or a claim reporting a HCPCS code for a DMEPOS item that differs from that associated with the provisional affirmation PA decision), or information not available at the time of a PA request. CMS had proposed that MACs would be required to “make reasonable efforts” to provide a PA decision within 10 days of receipt of all applicable information, unless this timeline could “seriously jeopardize the life or health of the beneficiary or the beneficiary’s ability to regain maximum function,” in which case the target review period would be 2 business days, and decisions on resubmissions would be rendered within 20 days. In response to commenters’ concerns that the proposed timeframes would delay care for beneficiaries, CMS agreed that “additional flexibility” may be necessary to protect beneficiary access to DMEPOS on the Required Prior Authorization List. CMS therefore is not finalizing the proposed PA timeframes in regulation. CMS instead will issue subregulatory guidance that specifies timeframes that are customized for the DMEPOS items subject to PA; this subregulatory guidance may provide for fewer days of review, as appropriate, but would not exceed the timeframes described in the proposed rule. CMS observes that the use of subregulatory guidance “allows for greater flexibility in the event timeline modifications are warranted.” CMS has finalized its proposal to implement the PA program nationally or locally, and to suspend or cease the PA program generally or for a particular item or items at any time without the need to undertake a separate rulemaking. The final rule also discusses, among other things: liability for an item on the Required Prior Authorization List if there is no PA authorization. In addition, the rule adds a contractor’s decision regarding prior authorization of coverage of DMEPOS items to the list of actions that are not initial determinations and therefore not appealable. The final rule is effective February 29, 2016. Given that CMS has not released the Required Prior Authorization List and the agency intends to announce certain key policy provisions in future subregulatory guidance, it is unclear when the new PA requirements will actually go into effect, or the number of items that initially will be included in the program.