U.S. flag

An official website of the United States government

Frequently Asked Questions

Frequently Asked Questions are used to provide additional information and/or statutory guidance not found in State Medicaid Director Letters, State Health Official Letters, or CMCS Informational Bulletins. The different sets of FAQs as originally released can be accessed below.

Showing 11 to 20 of 56 results

Can state Medicaid agencies access federal financial participation (FFP) to support system changes necessary to meet HIPAA, NIST cybersecurity, or MARS-E 2.0 standards?

For E&E and MMIS, enhanced FFP funding is available at 90 percent via the usual Advanced Planning Document process.

FAQ ID:94876

SHARE URL

If a state is reusing an MMIS system or module already certified in another state do they need to go through certification review and decision?

CMS encourages states to reuse modular solutions as much as possible. If a state can reuse a modular solution from another state with minimal changes or customization, CMS will work with the state to streamline the certification process as much as possible to leverage knowledge of the reused solution. However, CMS will still require a certification decision for each state implementation of reused solutions to ensure compliance with federal regulations.

FAQ ID:94896

SHARE URL

Which of the checklist paths (MITA, Module, Custom) described in the MECT are best for a state implementing a services-type solution?

All the criteria in the checklists (MITA, MMIS or Custom) are the same. The difference between checklists is the criteria organization within the checklists. If the services solution is innovative, unique, or an unconventional approach, then the custom checklist approach might be appropriate. The RO will work with the state and vendors to decide which checklist set is best suited for the state's certification. Both service and traditional-type solutions need to meet all certification criteria to ensure compliance with federal regulations.

FAQ ID:94901

SHARE URL

If the state conducts a staged rollout for implementing new MMIS Medicaid modules, will CMS pay for the overlapping costs?

Yes, CMS will support the costs for this kind of MMIS transition. We encourage states to ensure that both the current vendor's and new solutions provider's contracts account for this transition period and address a prorating of cost during this time. States should minimize the costs of transition by performing due diligence on the anticipated spending. The legacy system provider should be compensated for its role in ensuring a smooth transition, with a ramp-down of other operational costs. The new solutions provider should have deliverables in its contract that speak to the soft launch or phased launch approach, with an uptick in operational costs as the transition progresses.

FAQ ID:94906

SHARE URL

What security and privacy documents are state Medicaid agencies required to have for their MMIS?

State Medicaid agencies are required to have MMIS System Security Plan and Privacy Impact Assessment documents. State Medicaid agencies must perform regular routine security and privacy risk assessments to ensure the protection and safeguard of beneficiary data that is consistent with Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules. Please refer to the MECT for more details: https://www.medicaid.gov/medicaid/data-and-systems/mect/index.html

FAQ ID:94911

SHARE URL

Can the Systems Integrator (SI) be awarded contracts for development of modular components within the MMIS project?

Yes. While CMS envisions a discrete role for the System Integrator (SI) in each state, with specific focus on ensuring the integrity and interoperability of the Medicaid IT architecture and coherence of the various modules incorporated into the Medicaid system complex, it is permissible for an SI to provide modules as part of the overall solution. The target outcome for the SI in support of the state should be to foster best-in-breed solutions for Medicaid business requirements, with the SI responsible for the successful integration of the chosen solutions and infrastructure into a seamless functional system. The SI must ensure that all modules have open APIs and remain loosely coupled. More information on the SI role can be found in Section 1.7 of the Medicaid Enterprise Certification Life Cycle, part 01 of the MECT. States are encouraged to use an acquisition approach that limits the potential for conflict of interest an SI may have in choosing the modular solutions to be incorporated into the system. As described above, the goal is to avoid lock-in to a single vendor or an otherwise closed set of solutions.

FAQ ID:94916

SHARE URL

Can a state decide to be its own MMIS systems integrator?

CMS encourages the use of an SI outside the state agency, but states can consider themselves in that role if they can support that effort and if that decision is made with consultation and agreement from CMS. For more information about the role of the SI, see Section 1.7 in part 01 of MECT Medicaid Enterprise Certification Life Cycle. https://www.medicaid.gov/medicaid/data-and-systems/mect/index.html

FAQ ID:94921

SHARE URL

How do I withdraw a submission package?

A State may withdraw a submission package once it has been submitted to CMS. Withdrawing a submission package takes it out of contention and the submission package cannot be edited or resubmitted. Log in as State Point of Contact, and select the "Records" tab. Then select "Submission Packages" for your State. Next, select the link to the submission package you wish to withdraw. In the left panel, select "Related Actions". Next, select "Withdraw Submission Package". Then select the green button labeled "Withdraw Submission Package". A box will pop up, select "Yes". Once the submission package is withdrawn, you will be redirected to the Records screen. A yellow notification will appear briefly at the top of the page indicating "Action Completed Successfully".

FAQ ID:92891

SHARE URL

How do I allow CMS to view my submission package prior to submitting?

After the State Editor has forwarded the submission package to the State Point of Contact for Reviewing, the State Point of contact should log into MACPro. Then go to the "Records" tab and select "Submission Packages" for your state. Select the submission package you wish for CMS to view. In the left panel, select "Related Actions". Next, select "Allow CMS to View Screen". On the Allow CMS to View Screen page, select "Yes" under Visibility Setting, and then select the green "Update Visibility" button in the bottom right corner.

Note: Selecting this option will permit the CMS review team to see the screens in this submission package as they are now. It does not cause the package to be submitted as Draft or Official, and does not start a CMS review clock. Validation of the screens is not required. Notify your CMS contact that viewing is available and who you wish to see it; MACPro does not notify CMS staff. You can deselect this option at any time.

FAQ ID:92896

SHARE URL

What functions can my role perform?

Refer to the table below.

Role Actions
State Editor (SE)
  • Responsible for creating SPA submission packages
State Point of Contact (SPOC)
  • Responsible for reviewing and submitting the SPA submission package to CMS
  • Responds to Requests for Additional Information (RAIs) from CMS
  • Documents and reviews Correspondence Log
State Director (State Director)
  • Reviews and certifies SPA submission packages
State System Administrator (SSA)
  • Creates/maintains State Profile

FAQ ID:92901

SHARE URL
Results per page