Skip to main content

Medicaid Information Technology: Effective CMS Oversight and States' Sharing of Claims Processing and Information Retrieval Systems Can Reduce Costs

GAO-20-179 Published: Sep 09, 2020. Publicly Released: Sep 09, 2020.
Jump To:

Fast Facts

The Centers for Medicare & Medicaid Services (CMS) reimburses states for most Medicaid costs—health care costs and administrative costs, such as IT. CMS reimbursed states $34.3 billion for Medicaid IT systems in FY 2008-18.

The documentation of CMS's reviews for most IT funding requests 2016-2018 lacked information, indicating that reviews may not have been complete.

CMS is supposed to oversee states' use of funds. But the IT systems had little oversight from either CMS or state chief information officers. Also, CMS was no longer supporting efforts to reduce duplication by sharing state systems.

Our recommendations address the issues we found.

figure showing both federal and state funds going to Medicaid

Skip to Highlights

Highlights

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) has reimbursed billions of dollars to states for the development, operation, and maintenance of claims processing and information retrieval systems—the Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) systems. Specifically, from fiscal year 2008 through fiscal year 2018, states spent a total of $44.1 billion on their MMIS and E&E systems. CMS reimbursed the states $34.3 billion of that total amount (see figure).

Money Spent by States and Reimbursed by CMS from 2008–2018 for Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) Systems

Money Spent by States and Reimbursed by CMS from 2008–2018 for Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) Systems

For fiscal years 2016 through 2018, CMS approved 93 percent and disapproved 0.4 percent of MMIS funding requests, while for E&E it approved 81 percent and disapproved 1 percent of the requests. The remaining 6.6 percent of MMIS requests and 18 percent of E&E requests were either withdrawn by states or were pending. GAO estimates that CMS had some level of supporting evidence of its review for about 74 percent of MMIS requests and about 99 percent of E&E requests. However, GAO estimates that about 100 percent of E&E requests and 68 percent of MMIS requests lacked pertinent information that would be essential for indicating that a complete review had been performed. Among CMS requirements for system implementation funding is that states submit an alternatives analysis, feasibility study, and cost benefit analysis. However, GAO found that about 45 percent of such requests it sampled for fiscal years 2016 through 2018 did not include these required documents. The above weaknesses were due, in part, to a lack of formal, documented procedures for reviewing state funding requests.

CMS also lacked a risk-based process for overseeing systems after federal funds were provided. CMS provided helpful comments and recommendations to states in selected cases, but in other instances it did not. In two states that had contractors struggling to deliver successful projects, state officials said they had not received recommendations or technical assistance from CMS. The states eventually terminated the projects after spending a combined $38.5 million in federal funds. According to CMS officials, they rely largely on states to oversee systems projects. This perspective is consistent with a 2018 Office of Management and Budget (OMB) decision that federal information technology (IT) grants totaling about $9 billion annually would no longer be tracked on OMB's public web site on IT investment performance. Accordingly, the CMS and Health and Human Services chief information officers (CIO) are not involved in overseeing MMIS or E&E projects. Similarly, 21 of 47 states responding to GAO's survey reported that their state CIO had little or no involvement in overseeing their MMISs. Such non-involvement of officials with duties that should be heavily focused on successful acquisition and operation of IT projects could be hindering states' ability to effectively implement systems.

To improve oversight, CMS has begun a new outcome-based initiative that focuses the agency's review of state funding requests on the successful achievement of business outcomes. However, as of February 2020, CMS had not yet established a timeline for including MMIS and E&E systems in the new outcome-based process.

CMS had various initiatives aimed at reducing duplication of Medicaid systems (see table).

Description and Status of Centers for Medicare and Medicaid Services Initiatives Aimed at Reducing Duplication by Sharing, Leveraging, and Reusing Medicaid Information Technology

Initiative

Description

Implementation status

Number of surveyed states reporting use of the initiative

Reuse Repository

Used by states to collect and share reusable artifacts.

Made available in August 2017. As of January 2020, CMS was no longer supporting this initiative.

25 of the 50 reporting states

Poplin Project

Was to provide free, open-source application program interfaces for states to use in developing their modular Medicaid systems.

Initiative never fully implemented. As of January 2020, CMS was no longer supporting this initiative.

Three of the 50 reporting states

Open Source Provider Screening Module

Open-source module for states to use at no charge.

Made available in August 2018. As of January 2020, CMS was no longer supporting this initiative.

One of the 50 states reported attempting to use the module.

Medicaid Enterprise Cohort Meetings

A forum where states can discuss sharing, leveraging, and/or reuse of Medicaid technologies.

As of January 2020, Cohort meetings were being held on a monthly basis.

47 of the 50 states reported participating in the meetings.

Source: GAO analysis of agency data. | GAO-20-179

However, as of January 2020, the agency was no longer supporting most of these initiatives because they failed to produce the desired results. CMS regulations and GAO's prior work have highlighted the importance of reducing duplication by sharing and reusing Medicaid IT. To illustrate the potential for reducing duplication, 53 percent of state Medicaid officials responding to our survey reported using the same contractor to develop their MMIS. Nevertheless, selected states are taking the initiative to share systems or modules. Further support by CMS could result in additional sharing initiatives and potential cost savings.

Why GAO Did This Study

The Medicaid program is the largest source of health care funding for America's most at-risk populations and is funded jointly by states and the federal government.

GAO was asked to assess CMS's oversight of federal expenditures for MMIS and E&E systems used for Medicaid. This report examines (1) the amount of federal funds that CMS has provided to state Medicaid programs to support MMIS and E&E systems, (2) the extent to which CMS reviews and approves states' funding requests for the systems and oversees the use of these funds, and (3) CMS's and states' efforts to reduce potential duplication of Medicaid IT systems.

GAO assessed information related to MMIS and E&E systems, such as state expenditure data, federal regulations, and CMS guidance to the states for submitting funding requests, states' system funding requests, and IT project management documents. GAO also evaluated a generalizable sample of approved state funding requests from fiscal years 2016 through 2018 to analyze, among other things, CMS's review and approval process and conducted interviews with agency and state Medicaid officials. GAO also reviewed relevant regulations and guidance on promoting, sharing, and reusing MMIS and E&E technologies; and surveyed 50 states and six territories (hereafter referred to as states) regarding the MMIS and E&E systems, and assessed the complete or partial responses received from 50 states.

Recommendations

GAO is making nine recommendations to improve CMS's processes for approving and overseeing the federal funds for MMIS and E&E systems and for bolstering efforts to reduce potential duplication. Among these recommendations are that CMS should

develop formal, documented procedures that include specific steps to be taken in the advanced planning document review process and instructions on how CMS will document the reviews;

develop, in consultation with the HHS and CMS CIOs, a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to assist states that is aimed at improving the performance of the systems;

encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects;

establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems; and

identify, prior to approving funding for systems, similar projects that other states are pursuing so that opportunities to share, leverage, or reuse systems or system modules are considered.

In written comments on a draft of this report, the department concurred with eight of the nine recommendations, and described steps it had taken and/or planned to take to address them. The department did not state whether it concurred with GAO's recommendation to encourage state officials to consider involving state CIOs in Medicaid IT projects. HHS stated that it was unable to discern evidence as to whether a certain structure contributed to a specific outcome. GAO believes, consistent with federal law, that CIOs are critically important to the success of IT projects.

Recommendations for Executive Action

Agency Affected Recommendation Status
Centers for Medicare & Medicaid Services The Administrator of CMS should develop formal procedures that include specific steps to be taken in the APD review process, including how CMS will document the review (including the name of the reviewer, date of review, and what was reviewed); what documentation should be retained after the review; as well as decision-making criteria for approval or denial decisions for state Medicaid IT funding requests. (Recommendation 1)
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures (SOP) that included specific steps to be taken in the APD review process and the decision-making criteria for approval. For example, the SOP requires CMS to review APDs for completion of all required elements, the scope to ensure it matches the needs and objectives of the system, and that the total amount of funding is included in the request. In addition, the SOP also requires that CMS utilize its Medicaid Enterprise Systems Unified Workflow capability that tracks the review of the APD. For example, the workflow documents the name of the reviewer, the date of the review, and what was reviewed. The workflow also serves as a documentation management system that stores all of the documentation related to the APD and subsequent review.
Centers for Medicare & Medicaid Services The Administrator of CMS should, as part of the APD review process and prior to approval, verify that all of the required information (e.g. alternatives analysis, feasibility study, and cost benefit analysis) is included in the funding request. (Recommendation 2)
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that, as part of the APD review process and prior to approval, required reviewers to verify that all of the required information, such as an alternative analysis, feasibility study and cost benefit analysis, was included in the funding request.
Centers for Medicare & Medicaid Services The Administrator of CMS should ensure that all APD-related artifacts are retained within the designated CMS document management system, including documentation of key information from meetings and email communications with the states, the MITA self-assessment and independent verification and validation reports, when creating APD decision packages. (Recommendation 3)
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that required reviewers to store all APD-related artifacts within its designated CMS document management system, the Medicaid Enterprise Systems Unified Workflow. Further, the procedures identified steps regarding how CMS would validate that all documents were retained within the system.
Centers for Medicare & Medicaid Services The Administrator of CMS should require analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle instead of individual APDs. (Recommendation 4)
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that required reviewers to maintain all APD-related artifacts within its document management system. The procedures also included instructions that required analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle, instead of individual APDs. For example, CMS's Unified Workflow captures the APDs, their review history, and related artifacts in one centralized system. The Unified Workflow also has the capability to link APDs and their related projects together by utilizing the parent/child feature. Lastly, CMS maintains a SharePoint page to store state portfolios, including APDs, which allows them to identify and track all active MMIS and E&E projects across the states.
Centers for Medicare & Medicaid Services The Administrator of CMS should, in consultation with the HHS and CMS CIOs, develop a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to states to assist them in improving the performance of the systems, with consideration to those that are high-cost and performing poorly. (Recommendation 5)
Open
According to HHS officials, as of September 2021, CMS was in the process of developing a standard approach to assess and visualize the health of states Medicaid Enterprise System projects. The officials added that this standard approach will enable the agency to make more consistent and better-informed decisions about when and where to direct technical assistance and future investments to realize measurable improvement for Medicaid beneficiaries, providers, and administrators. Further, according to HHS officials, CMS is in the process of updating its draft regulation, which, as of December 2022, was on hold due to the pandemic and transition of administrations. HHS officials also stated that they plan to prepare recommendations for the new CMS leadership and expect to release new guidance on subjects, such as testing, improving outcomes, and system reuse but did not provide an estimated completion date. GAO will continue to monitor the implementation of this recommendation.
Centers for Medicare & Medicaid Services The Administrator of CMS should encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects. (Recommendation 6)
Open
In November 2021, CMS officials stated that as part of their APD approval process, the agency works with states to ensure that they have the appropriate technology leadership and business sponsorship in place for their significant IT development efforts. In addition, in December 2022, CMS officials stated that new guidance was released in April 2022 to ensure a more comprehensive analysis of CMS funded state systems functionality. The officials added that the new guidance focuses on increasing accountability and state flexibility by creating an outcomes-based oversight model for state systems certification. While an outcomes-based oversight model is a positive step, the new model does not include information about how states should consider involving their CIOs in overseeing Medicaid IT projects. GAO will continue to monitor the implementation of this recommendation.
Centers for Medicare & Medicaid Services The Administrator of CMS should establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems. (Recommendation 7)
Closed – Implemented
in April 2022, CMS issued new guidance for implementing its outcome-based certification process for MMIS and E&E systems. The guidance includes specific steps to be taken by CMS to oversee and assess the success of these systems. For example, according to the guidance, CMS state officers are required to review evidence, such as metrics that states collect and report to CMS, to determine whether the system is achieving the identified outcomes. Specifically, states must report annually to CMS state officers on key operational metrics, such as timely eligibility determinations or claims payment. If after the review, CMS state officers determine that the system does not meet certification requirements, the state officers will work with the state on remediation of the findings and next steps to ensure that problems are adequately addressed before determining a certification decision. By undertaking these efforts, CMS is better positioned to improve its oversight and make funding decisions for state systems to support the Medicaid program.
Centers for Medicare & Medicaid Services The Administrator of CMS should establish documented procedures for how the results of the outcome-based certification process will be used for conducting oversight and making funding decisions. The procedures should include specific steps that CMCS will take to oversee individual state MMIS and E&E projects and how it will demonstrate that the steps have been taken. (Recommendation 8)
Closed – Implemented
On May 24, 2023, CMS issued new guidance, effective immediately, for its outcome-based certification process for how the results of the outcome-based certification process for MMIS and E&E systems will be used for conducting oversight and making funding decisions. The guidance includes specific steps to be taken by CMS to oversee individual state MMIS and E&E systems and how it will demonstrate that the steps have been taken. For example, the guidance outlines CMS's approval process for MMIS and E&E systems and state development of corrective action plans for systems CMS determines are non-compliant. Specifically, the guidance states that during the approval process, CMS is required to review evidence, such as metrics that states collect and report to CMS that correspond to agreed-upon outcomes. Further, CMS is to review independent verification and validation contractor reports to determine whether the state is in compliance with conditions to approve enhanced funding. According to the guidance, CMS will not approve system operational expenditures if the state does not submit the required evidence demonstrating successful system performance. Finally, the guidance states that when CMS determines that the system is no longer compliant with conditions of enhanced funding, states are required to develop corrective action plans and timelines for remediation. The states are then required to provide their CMS state officer with ongoing monthly status updates on system performance to resolve outstanding issues. Subsequently, the state officer is to monitor project progress against the corrective action plan until the issue is resolved. By undertaking these efforts, CMS is better positioned to improve its oversight and make funding decisions for state systems to support the Medicaid program.
Centers for Medicare & Medicaid Services Prior to approving funding for MMIS and E&E systems, the Administrator of CMS should identify areas of duplication or common functionality, such as core MMIS modules, in order to facilitate sharing, leveraging, or reusing Medicaid technologies. CMS should share the results of the review with the state or territory requesting federal funding for a duplicative or similar project and take steps to encourage states to share, leverage, or reuse Medicaid technologies, where possible. (Recommendation 9)
Open
As of April 2023, CMS established a certification repository that functions as a centralized location for the agency, states, and vendors to learn, share, and reuse content related to the CMS certification process. However, CMS has not provided evidence that, prior to approving funding for MMIS and E&E systems, it has established processes to identify areas of duplication or common functionality, such as core MMIS modules, in order to facilitate sharing, leveraging, or reusing Medicaid technologies. GAO will continue to monitor the implementation of this recommendation.

Full Report

Office of Public Affairs

Topics

Information systemsInformation technologyMedicaidMedicaid programMedicaid servicesMedical information systemsIT projectsFederal fundsManagement information systemsInformation storage and retrieval