Medicaid Information Technology:

Effective CMS Oversight and States' Sharing of Claims Processing and Information Retrieval Systems Can Reduce Costs

GAO-20-179: Published: Sep 9, 2020. Publicly Released: Sep 9, 2020.

Additional Materials:

Contact:

Vijay D’souza
(202) 512-6240
dsouzav@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

The Centers for Medicare & Medicaid Services (CMS) reimburses states for most Medicaid costs—health care costs and administrative costs, such as IT. CMS reimbursed states $34.3 billion for Medicaid IT systems in FY 2008-18.

The documentation of CMS's reviews for most IT funding requests 2016-2018 lacked information, indicating that reviews may not have been complete.

CMS is supposed to oversee states' use of funds. But the IT systems had little oversight from either CMS or state chief information officers. Also, CMS was no longer supporting efforts to reduce duplication by sharing state systems.

Our recommendations address the issues we found.

figure showing both federal and state funds going to Medicaid

Additional Materials:

Contact:

Vijay D’souza
(202) 512-6240
dsouzav@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) has reimbursed billions of dollars to states for the development, operation, and maintenance of claims processing and information retrieval systems—the Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) systems. Specifically, from fiscal year 2008 through fiscal year 2018, states spent a total of $44.1 billion on their MMIS and E&E systems. CMS reimbursed the states $34.3 billion of that total amount (see figure).

Money Spent by States and Reimbursed by CMS from 2008–2018 for Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) Systems

Money Spent by States and Reimbursed by CMS from 2008–2018 for Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) Systems

For fiscal years 2016 through 2018, CMS approved 93 percent and disapproved 0.4 percent of MMIS funding requests, while for E&E it approved 81 percent and disapproved 1 percent of the requests. The remaining 6.6 percent of MMIS requests and 18 percent of E&E requests were either withdrawn by states or were pending. GAO estimates that CMS had some level of supporting evidence of its review for about 74 percent of MMIS requests and about 99 percent of E&E requests. However, GAO estimates that about 100 percent of E&E requests and 68 percent of MMIS requests lacked pertinent information that would be essential for indicating that a complete review had been performed. Among CMS requirements for system implementation funding is that states submit an alternatives analysis, feasibility study, and cost benefit analysis. However, GAO found that about 45 percent of such requests it sampled for fiscal years 2016 through 2018 did not include these required documents. The above weaknesses were due, in part, to a lack of formal, documented procedures for reviewing state funding requests.

CMS also lacked a risk-based process for overseeing systems after federal funds were provided. CMS provided helpful comments and recommendations to states in selected cases, but in other instances it did not. In two states that had contractors struggling to deliver successful projects, state officials said they had not received recommendations or technical assistance from CMS. The states eventually terminated the projects after spending a combined $38.5 million in federal funds. According to CMS officials, they rely largely on states to oversee systems projects. This perspective is consistent with a 2018 Office of Management and Budget (OMB) decision that federal information technology (IT) grants totaling about $9 billion annually would no longer be tracked on OMB's public web site on IT investment performance. Accordingly, the CMS and Health and Human Services chief information officers (CIO) are not involved in overseeing MMIS or E&E projects. Similarly, 21 of 47 states responding to GAO's survey reported that their state CIO had little or no involvement in overseeing their MMISs. Such non-involvement of officials with duties that should be heavily focused on successful acquisition and operation of IT projects could be hindering states' ability to effectively implement systems.

To improve oversight, CMS has begun a new outcome-based initiative that focuses the agency's review of state funding requests on the successful achievement of business outcomes. However, as of February 2020, CMS had not yet established a timeline for including MMIS and E&E systems in the new outcome-based process.

CMS had various initiatives aimed at reducing duplication of Medicaid systems (see table).

Description and Status of Centers for Medicare and Medicaid Services Initiatives Aimed at Reducing Duplication by Sharing, Leveraging, and Reusing Medicaid Information Technology

Initiative

Description

Implementation status

Number of surveyed states reporting use of the initiative

Reuse Repository

Used by states to collect and share reusable artifacts.

Made available in August 2017. As of January 2020, CMS was no longer supporting this initiative.

25 of the 50 reporting states

Poplin Project

Was to provide free, open-source application program interfaces for states to use in developing their modular Medicaid systems.

Initiative never fully implemented. As of January 2020, CMS was no longer supporting this initiative.

Three of the 50 reporting states

Open Source Provider Screening Module

Open-source module for states to use at no charge.

Made available in August 2018. As of January 2020, CMS was no longer supporting this initiative.

One of the 50 states reported attempting to use the module.

Medicaid Enterprise Cohort Meetings

A forum where states can discuss sharing, leveraging, and/or reuse of Medicaid technologies.

As of January 2020, Cohort meetings were being held on a monthly basis.

47 of the 50 states reported participating in the meetings.

Source: GAO analysis of agency data. | GAO-20-179

However, as of January 2020, the agency was no longer supporting most of these initiatives because they failed to produce the desired results. CMS regulations and GAO's prior work have highlighted the importance of reducing duplication by sharing and reusing Medicaid IT. To illustrate the potential for reducing duplication, 53 percent of state Medicaid officials responding to our survey reported using the same contractor to develop their MMIS. Nevertheless, selected states are taking the initiative to share systems or modules. Further support by CMS could result in additional sharing initiatives and potential cost savings.

Why GAO Did This Study

The Medicaid program is the largest source of health care funding for America's most at-risk populations and is funded jointly by states and the federal government.

GAO was asked to assess CMS's oversight of federal expenditures for MMIS and E&E systems used for Medicaid. This report examines (1) the amount of federal funds that CMS has provided to state Medicaid programs to support MMIS and E&E systems, (2) the extent to which CMS reviews and approves states' funding requests for the systems and oversees the use of these funds, and (3) CMS's and states' efforts to reduce potential duplication of Medicaid IT systems.

GAO assessed information related to MMIS and E&E systems, such as state expenditure data, federal regulations, and CMS guidance to the states for submitting funding requests, states' system funding requests, and IT project management documents. GAO also evaluated a generalizable sample of approved state funding requests from fiscal years 2016 through 2018 to analyze, among other things, CMS's review and approval process and conducted interviews with agency and state Medicaid officials. GAO also reviewed relevant regulations and guidance on promoting, sharing, and reusing MMIS and E&E technologies; and surveyed 50 states and six territories (hereafter referred to as states) regarding the MMIS and E&E systems, and assessed the complete or partial responses received from 50 states.

What GAO Recommends

GAO is making nine recommendations to improve CMS's processes for approving and overseeing the federal funds for MMIS and E&E systems and for bolstering efforts to reduce potential duplication. Among these recommendations are that CMS should

develop formal, documented procedures that include specific steps to be taken in the advanced planning document review process and instructions on how CMS will document the reviews;

develop, in consultation with the HHS and CMS CIOs, a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to assist states that is aimed at improving the performance of the systems;

encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects;

establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems; and

identify, prior to approving funding for systems, similar projects that other states are pursuing so that opportunities to share, leverage, or reuse systems or system modules are considered.

In written comments on a draft of this report, the department concurred with eight of the nine recommendations, and described steps it had taken and/or planned to take to address them. The department did not state whether it concurred with GAO's recommendation to encourage state officials to consider involving state CIOs in Medicaid IT projects. HHS stated that it was unable to discern evidence as to whether a certain structure contributed to a specific outcome. GAO believes, consistent with federal law, that CIOs are critically important to the success of IT projects.

For more information, contact Vijay D’Souza at (202) 512-6240 or dsouzav@gao.gov.

Recommendations for Executive Action

  1. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should develop formal procedures that include specific steps to be taken in the APD review process, including how CMS will document the review (including the name of the reviewer, date of review, and what was reviewed); what documentation should be retained after the review; as well as decision-making criteria for approval or denial decisions for state Medicaid IT funding requests. (Recommendation 1)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  2. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should, as part of the APD review process and prior to approval, verify that all of the required information (e.g. alternatives analysis, feasibility study, and cost benefit analysis) is included in the funding request. (Recommendation 2)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  3. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should ensure that all APD-related artifacts are retained within the designated CMS document management system, including documentation of key information from meetings and email communications with the states, the MITA self-assessment and independent verification and validation reports, when creating APD decision packages. (Recommendation 3)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  4. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should require analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle instead of individual APDs. (Recommendation 4)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  5. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should, in consultation with the HHS and CMS CIOs, develop a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to states to assist them in improving the performance of the systems, with consideration to those that are high-cost and performing poorly. (Recommendation 5)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  6. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects. (Recommendation 6)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  7. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems. (Recommendation 7)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  8. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Administrator of CMS should establish documented procedures for how the results of the outcome-based certification process will be used for conducting oversight and making funding decisions. The procedures should include specific steps that CMCS will take to oversee individual state MMIS and E&E projects and how it will demonstrate that the steps have been taken. (Recommendation 8)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

  9. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: Prior to approving funding for MMIS and E&E systems, the Administrator of CMS should identify areas of duplication or common functionality, such as core MMIS modules, in order to facilitate sharing, leveraging, or reusing Medicaid technologies. CMS should share the results of the review with the state or territory requesting federal funding for a duplicative or similar project and take steps to encourage states to share, leverage, or reuse Medicaid technologies, where possible. (Recommendation 9)

    Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services

 

Explore the full database of GAO's Open Recommendations »

Oct 13, 2020

Oct 7, 2020

Sep 30, 2020

Sep 29, 2020

Sep 28, 2020

Sep 14, 2020

Sep 8, 2020

Aug 31, 2020

Aug 3, 2020

Jun 1, 2020

Looking for more? Browse all our products here