Frequently Asked Questions

To reduce potential conflict of interest, CMS is ensuring that states are arranging IV&V services through contracts that should be owned outside of the agency that owns the MMIS or E&E project. The oversight organization for the IV&V contractor should not be involved in oversight of the development effort, a stakeholder in the business implementation, or the DDI contractor. The IV&V contract monitor should be aware of system development problem solving, reporting, and contractor management. This contract oversight provides true independence between the IV&V contractor and system development teams. This requirement is consistent with other HHS agencies' practices and industry best practices.

CMS encourages states to reuse modular solutions as much as possible. If a state can reuse a modular solution from another state with minimal changes or customization, CMS will work with the state to streamline the certification process as much as possible to leverage knowledge of the reused solution. However, CMS will still require a certification decision for each state implementation of reused solutions to ensure compliance with federal regulations.

All the criteria in the checklists (MITA, MMIS or Custom) are the same. The difference between checklists is the criteria organization within the checklists. If the services solution is innovative, unique, or an unconventional approach, then the custom checklist approach might be appropriate. The RO will work with the state and vendors to decide which checklist set is best suited for the state's certification. Both service and traditional-type solutions need to meet all certification criteria to ensure compliance with federal regulations.

Yes, CMS will support the costs for this kind of MMIS transition. We encourage states to ensure that both the current vendor's and new solutions provider's contracts account for this transition period and address a prorating of cost during this time. States should minimize the costs of transition by performing due diligence on the anticipated spending. The legacy system provider should be compensated for its role in ensuring a smooth transition, with a ramp-down of other operational costs. The new solutions provider should have deliverables in its contract that speak to the soft launch or phased launch approach, with an uptick in operational costs as the transition progresses.

State Medicaid agencies are required to have MMIS System Security Plan and Privacy Impact Assessment documents. State Medicaid agencies must perform regular routine security and privacy risk assessments to ensure the protection and safeguard of beneficiary data that is consistent with Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules. Please refer to the MECT for more details: https://www.medicaid.gov/medicaid/data-and-systems/mect/index.html

Yes. While CMS envisions a discrete role for the System Integrator (SI) in each state, with specific focus on ensuring the integrity and interoperability of the Medicaid IT architecture and coherence of the various modules incorporated into the Medicaid system complex, it is permissible for an SI to provide modules as part of the overall solution. The target outcome for the SI in support of the state should be to foster best-in-breed solutions for Medicaid business requirements, with the SI responsible for the successful integration of the chosen solutions and infrastructure into a seamless functional system. The SI must ensure that all modules have open APIs and remain loosely coupled. More information on the SI role can be found in Section 1.7 of the Medicaid Enterprise Certification Life Cycle, part 01 of the MECT. States are encouraged to use an acquisition approach that limits the potential for conflict of interest an SI may have in choosing the modular solutions to be incorporated into the system. As described above, the goal is to avoid lock-in to a single vendor or an otherwise closed set of solutions.

CMS encourages the use of an SI outside the state agency, but states can consider themselves in that role if they can support that effort and if that decision is made with consultation and agreement from CMS. For more information about the role of the SI, see Section 1.7 in part 01 of MECT Medicaid Enterprise Certification Life Cycle. https://www.medicaid.gov/medicaid/data-and-systems/mect/index.html

All states are required to adopt the AAC and professional dispensing fee methodology; however, it is not required to be adopted at the individual claim level, but in the aggregate. In accordance with the regulatory requirements at 42 CFR 447.512(b), the state is responsible for establishing a payment methodology, that must not exceed, in the aggregate, payment levels that the agency has determined by applying the lower of the AAC plus a professional dispensing fee or the providers' usual and customary charges to the general public. In conjunction with this the state is also responsible to ensure that pharmacy reimbursement is consistent

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set.

If a state is already making payment for prescription drugs under its state plan based on AAC, it may continue to use that methodology. However, if a state decides to change its AAC model of reimbursement, (e.g., the state decides to use the National Average Drug Acquisition Cost (NADAC) instead of a state survey to implement a payment methodology based on AAC), the state must submit a new SPA through the formal SPA process for review.

Additionally, the state should review its currently approved professional dispensing fee (PDF) to determine if, in light of the regulation (42 CFR 447.518), the PDF needs to be revised and a SPA needs to be submitted. The state does not have to submit a new SPA to provide assurance that its dispensing fee is reasonable.

Furthermore, we expect that all states, even those currently operating under an AAC reimbursement methodology, will evaluate their current state plans to determine if a SPA will be required to comply with the reimbursement requirements (including, but not limited to, AAC, PDF, 340B and the federal upper limits (FULs)).

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set.

No, CMS will not perform an annual review of PDFs; however, states must consider both the ingredient cost reimbursement and the PDF reimbursement when proposing changes to ensure that total reimbursement to the pharmacy provider is calculated in accordance with requirements of section 1902(a)(30)(A) of the Act.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set.