The Medicare Part C UM annual data submission: what to report

The Medicare Part C UM annual data submission is CMS's yearly collection, under information collection CMS-10913 (OMB 0938-1488), of the internal coverage criteria every Medicare Advantage organization uses to process prior authorization for Part C services, its own and those of its delegated entities and vendors. The first submission covered the 2026 coverage year and was due on 30 April 2026; from 2027 it is due each 28 February, through CMS's Health Plan Management System (HPMS). Each criteria document is one row with five fields: its name, the services it covers, the Medicare contractor jurisdictions where it applies, the entities that use it and the organization or vendor behind it. The filing is easy to format and hard to get right, because it requires a plan to know exactly which criteria it applies, where and through whom. Botminds' Medical Policy Search keeps that library dated, with each policy's plan types and Medicare rule, so the list can be drawn from the source rather than rebuilt.

What is the Part C UM annual data submission?

It is CMS's yearly inventory of internal coverage criteria, collected so the agency can see which services Medicare Advantage plans manage with their own criteria and how. CMS stated the purpose in the collection's supporting statement.

“…to develop a national landscape of services subject to internal coverage criteria during the prior authorization process, and to assess internal coverage criteria trends, and perform oversight activities.”

CMS, supporting statement for CMS-10913, on who uses the data

The filing exists because of the 2023 rule that limits internal criteria. Since 1 January 2024 a Medicare Advantage plan may apply its own coverage criteria to a basic benefit only where Medicare's criteria are not fully established, and must publish them with their evidence and rationale (42 CFR 422.101(b)(6)). The annual submission tells CMS where to look. It does not ask for the evidence itself; that must already be public.

What is CMS-10913?

CMS-10913 is the form number of the information collection, approved under the Paperwork Reduction Act as OMB control number 0938-1488, valid until 30 September 2028. CMS bases it on its duty to oversee Medicare Advantage contracts under section 1857(d) of the Social Security Act and 42 CFR 422.503 and 422.504, and on the rule that plans must report utilization information CMS requires (42 CFR 422.516(a)). The package on CMS's page holds the protocol, the record layout with examples, the supporting statement, CMS's responses to public comments and a crosswalk of what changed between the proposal and the final version (CMS).

CMS estimated the burden at 15 hours per organization a year, priced at an adjusted $92 an hour for two computer systems analysts and a compliance officer, across 175 organizations: $241,500 in total. That estimate assumes the plan already knows its criteria; the hours grow with every criterion that has to be traced to a vendor, a delegate or a jurisdiction for the first time.

When is the UM annual data submission due?

By 28 February each year for that calendar year's criteria; for 2026 only, CMS extended the first deadline to 30 April. The reporting period is the calendar year of the due date, so the February 2027 file lists the criteria approved for use in 2027, and contracts not renewing for a year are left out of that year's file.

The calendar puts the work in the autumn. CMS expects the list to follow the UM committee's approvals: since the committee must approve criteria before they are used (42 CFR 422.137), CMS said it expects the information to be largely collected before the year in which the criteria are used. A plan whose committee approves next year's editions in November and December has its filing content by January, if the approvals are recorded per criteria document.

What must be reported in the UM annual data submission?

Five fields per criteria document, as the checklist at the top of this page sets out: the document's name or identifier, the Part C services it covers that require prior authorization, the MAC jurisdictions where it applies, the entities that use it and the organization or vendor responsible for it. The file goes in at the parent-organization level, with each contract associated with a file; one file for all contracts is allowed.

What is not asked matters too. CMS removed a column for the date of the most recent approval and a column for the website link after comments said they would need manual work; it kept the vendor column because, in its words, it gives “valuable insight into organizations’ UM practices.” Plans should still keep the approval date and the public link for each row in their own working file, because both are what an auditor asks for next.

What counts as internal coverage criteria for the submission?

Every internal criterion applied to a Part C service that requires prior authorization during the year, by the organization or any delegated entity, including Part B drugs, and including criteria developed by vendors. The protocol excludes criteria used only for concurrent review, retrospective review, payment review or other determinations that are not pre-service, and excludes Part B step therapy policies; CMS's responses also leave out supplemental benefits, Medicaid-only services and services Medicare does not cover. For the meaning of ‘service’, CMS points to the definition in 42 CFR 400.202.

CMS's November 2025 instructions also say how to build the list: “This data collection does not require a review of previous claims or request data; instead, it should be populated based on the ICC approved for use by the UM committee for the 2026 calendar year.” Start from the list of services that require prior authorization, which plans already maintain, then find the internal criteria that apply to each. What makes a criterion internal in the first place is the test that decides whether a row belongs in the file.

Do delegated entities' criteria have to be reported?

Yes. The collection covers criteria used by the organization and by its first tier, downstream and related entities (FDRs), such as a radiology benefit manager or a post-acute review vendor, and column D names which entities use each document. CMS added shortcuts after comments: ALL when every entity uses it, or ‘All excluding’ followed by the exceptions. A delegate that applies its own edition of a vendor's criteria in one jurisdiction is a separate row.

Delegation is where most plans will find gaps. A plan may know that its imaging benefit manager uses a licensed set but not which edition, in which jurisdictions, or with which local modifications. The contract with the delegate is the place to require that information; Medicare Advantage organizations must keep books and records on their contracts for 10 years (42 CFR 422.504), and this list is now one of them.

How do you submit the UM universe in HPMS?

Through the Utilization Management module of HPMS, which opened on 26 November 2025. Plan users reach it from the HPMS home page under Monitoring, then Utilization Management, and should first download the module's documentation: a user guide, an annual submission guide with the record layout, and a sample data file. The universe is a tab-delimited text file with a header row; files can be uploaded and overwritten as often as needed before the due date without penalty, and CMS may validate submissions and ask for resubmission. The protocol is blunt about format: a file that departs from the record layout is rejected (CMS-10913 protocol).

What CMS dropped, and what it may do next

CMS cut the collection hard between proposal and final version. It had proposed an annual collection plus an audit protocol with a list of targeted services, a root-cause analysis and supplemental questions, aimed at checking internal criteria against 42 CFR 422.101 and 422.137. After comments about duplicated audits it finalized only the annual submission, limited it to prior authorization, and dropped two columns. It also considered, and decided against for now, a public repository of the filings, and said it was not conducting any UM audits in 2025.

The direction is clear even where the next step is not. CMS said in its September 2025 memo that it “will consider incorporating a review of internal coverage criteria into CMS program audits in future protocol revisions.” A plan should treat each row of the file as something an auditor may one day sample: the criteria document, its edition, its public evidence and the decisions made under it.

Assembling the filing from the policy library you have

Build it from the library, not from memory. Start with the prior authorization list for the year; map each service to every criteria document that applies, the plan's and each delegate's; mark which documents are internal criteria and which are Medicare's own NCDs and LCDs applied as written; add the jurisdictions and the entities; and record the vendor. Then check each internal row against the public site: if the criteria, evidence summary, sources and rationale are not all there, the filing has just found a compliance gap.

The library the filing is drawn from: each policy with its plan types and the Medicare rule beside it

The solution helps with the parts that need dates. Its version finder knows which edition of each policy was approved for use in the year being filed, and when the committee approved it; its Medicare rule checker marks where a policy goes beyond Medicare's rule, which is where a criterion is either internal and must be filed with public evidence, or should not be applied to Medicare Advantage members at all. It does not file with CMS or decide what is internal; compliance and the director of medical policy do. The medical policy calendar shows where the filing sits in the year; to see the library behind it, start from Medical Policy Search.

Each edition with its committee approval date, the detail the filing's working copy should keep

Questions people ask

Do we report criteria that only restate an NCD or LCD?

The filing asks for internal coverage criteria, and Medicare's own NCDs and applicable LCDs applied as written are not internal. Where one plan document mixes Medicare's criteria with the plan's additions, the safer course is to report the document and make sure its public rationale identifies which criteria are the plan's own.

Is the UM annual data submission made public?

Not by CMS for now. CMS asked for comment on publishing the filings in a central repository and, after objections, decided not to pursue it at this time. The internal criteria themselves, with evidence and rationale, must already be publicly accessible on the plan's or a vendor's website.

What if we find an error after submitting?

Before the due date, upload a corrected file; CMS's instructions allow overwriting as many times as needed without penalty. After the due date, CMS may validate the file and ask for a resubmission; questions go to the Part C UM audits mailbox listed on CMS's page.

Does the submission include supplemental benefits or Medicaid services?

No. CMS's responses to comments exclude supplemental-benefit policies, Medicaid-only services and services Medicare does not cover, and the protocol excludes Part B step therapy.

Who should own the filing inside a plan?

Compliance owns the submission; the director of medical policy owns its content; delegation oversight supplies the delegates' criteria. CMS's burden estimate assumed two computer systems analysts and a compliance officer, which reflects the file's format, not the judgment about what counts as internal criteria.