Medicaid Information Technology: Effective CMS Oversight and States' Sharing of Claims Processing and Information Retrieval Systems Can Reduce Costs
Fast Facts
The Centers for Medicare & Medicaid Services (CMS) reimburses states for most Medicaid costs—health care costs and administrative costs, such as IT. CMS reimbursed states $34.3 billion for Medicaid IT systems in FY 2008-18.
The documentation of CMS's reviews for most IT funding requests 2016-2018 lacked information, indicating that reviews may not have been complete.
CMS is supposed to oversee states' use of funds. But the IT systems had little oversight from either CMS or state chief information officers. Also, CMS was no longer supporting efforts to reduce duplication by sharing state systems.
Our recommendations address the issues we found.
Highlights
What GAO Found
The Centers for Medicare and Medicaid Services (CMS) has reimbursed billions of dollars to states for the development, operation, and maintenance of claims processing and information retrieval systems—the Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) systems. Specifically, from fiscal year 2008 through fiscal year 2018, states spent a total of $44.1 billion on their MMIS and E&E systems. CMS reimbursed the states $34.3 billion of that total amount (see figure).
Money Spent by States and Reimbursed by CMS from 2008–2018 for Medicaid Management Information Systems (MMIS) and Eligibility and Enrollment (E&E) Systems
For fiscal years 2016 through 2018, CMS approved 93 percent and disapproved 0.4 percent of MMIS funding requests, while for E&E it approved 81 percent and disapproved 1 percent of the requests. The remaining 6.6 percent of MMIS requests and 18 percent of E&E requests were either withdrawn by states or were pending. GAO estimates that CMS had some level of supporting evidence of its review for about 74 percent of MMIS requests and about 99 percent of E&E requests. However, GAO estimates that about 100 percent of E&E requests and 68 percent of MMIS requests lacked pertinent information that would be essential for indicating that a complete review had been performed. Among CMS requirements for system implementation funding is that states submit an alternatives analysis, feasibility study, and cost benefit analysis. However, GAO found that about 45 percent of such requests it sampled for fiscal years 2016 through 2018 did not include these required documents. The above weaknesses were due, in part, to a lack of formal, documented procedures for reviewing state funding requests.
CMS also lacked a risk-based process for overseeing systems after federal funds were provided. CMS provided helpful comments and recommendations to states in selected cases, but in other instances it did not. In two states that had contractors struggling to deliver successful projects, state officials said they had not received recommendations or technical assistance from CMS. The states eventually terminated the projects after spending a combined $38.5 million in federal funds. According to CMS officials, they rely largely on states to oversee systems projects. This perspective is consistent with a 2018 Office of Management and Budget (OMB) decision that federal information technology (IT) grants totaling about $9 billion annually would no longer be tracked on OMB's public web site on IT investment performance. Accordingly, the CMS and Health and Human Services chief information officers (CIO) are not involved in overseeing MMIS or E&E projects. Similarly, 21 of 47 states responding to GAO's survey reported that their state CIO had little or no involvement in overseeing their MMISs. Such non-involvement of officials with duties that should be heavily focused on successful acquisition and operation of IT projects could be hindering states' ability to effectively implement systems.
To improve oversight, CMS has begun a new outcome-based initiative that focuses the agency's review of state funding requests on the successful achievement of business outcomes. However, as of February 2020, CMS had not yet established a timeline for including MMIS and E&E systems in the new outcome-based process.
CMS had various initiatives aimed at reducing duplication of Medicaid systems (see table).
Description and Status of Centers for Medicare and Medicaid Services Initiatives Aimed at Reducing Duplication by Sharing, Leveraging, and Reusing Medicaid Information Technology
|
Initiative |
Description |
Implementation status |
Number of surveyed states reporting use of the initiative |
|
Reuse Repository |
Used by states to collect and share reusable artifacts. |
Made available in August 2017. As of January 2020, CMS was no longer supporting this initiative. |
25 of the 50 reporting states |
|
Poplin Project |
Was to provide free, open-source application program interfaces for states to use in developing their modular Medicaid systems. |
Initiative never fully implemented. As of January 2020, CMS was no longer supporting this initiative. |
Three of the 50 reporting states |
|
Open Source Provider Screening Module |
Open-source module for states to use at no charge. |
Made available in August 2018. As of January 2020, CMS was no longer supporting this initiative. |
One of the 50 states reported attempting to use the module. |
|
Medicaid Enterprise Cohort Meetings |
A forum where states can discuss sharing, leveraging, and/or reuse of Medicaid technologies. |
As of January 2020, Cohort meetings were being held on a monthly basis. |
47 of the 50 states reported participating in the meetings. |
Source: GAO analysis of agency data. | GAO-20-179
However, as of January 2020, the agency was no longer supporting most of these initiatives because they failed to produce the desired results. CMS regulations and GAO's prior work have highlighted the importance of reducing duplication by sharing and reusing Medicaid IT. To illustrate the potential for reducing duplication, 53 percent of state Medicaid officials responding to our survey reported using the same contractor to develop their MMIS. Nevertheless, selected states are taking the initiative to share systems or modules. Further support by CMS could result in additional sharing initiatives and potential cost savings.
Why GAO Did This Study
The Medicaid program is the largest source of health care funding for America's most at-risk populations and is funded jointly by states and the federal government.
GAO was asked to assess CMS's oversight of federal expenditures for MMIS and E&E systems used for Medicaid. This report examines (1) the amount of federal funds that CMS has provided to state Medicaid programs to support MMIS and E&E systems, (2) the extent to which CMS reviews and approves states' funding requests for the systems and oversees the use of these funds, and (3) CMS's and states' efforts to reduce potential duplication of Medicaid IT systems.
GAO assessed information related to MMIS and E&E systems, such as state expenditure data, federal regulations, and CMS guidance to the states for submitting funding requests, states' system funding requests, and IT project management documents. GAO also evaluated a generalizable sample of approved state funding requests from fiscal years 2016 through 2018 to analyze, among other things, CMS's review and approval process and conducted interviews with agency and state Medicaid officials. GAO also reviewed relevant regulations and guidance on promoting, sharing, and reusing MMIS and E&E technologies; and surveyed 50 states and six territories (hereafter referred to as states) regarding the MMIS and E&E systems, and assessed the complete or partial responses received from 50 states.
Recommendations
GAO is making nine recommendations to improve CMS's processes for approving and overseeing the federal funds for MMIS and E&E systems and for bolstering efforts to reduce potential duplication. Among these recommendations are that CMS should
develop formal, documented procedures that include specific steps to be taken in the advanced planning document review process and instructions on how CMS will document the reviews;
develop, in consultation with the HHS and CMS CIOs, a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to assist states that is aimed at improving the performance of the systems;
encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects;
establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems; and
identify, prior to approving funding for systems, similar projects that other states are pursuing so that opportunities to share, leverage, or reuse systems or system modules are considered.
In written comments on a draft of this report, the department concurred with eight of the nine recommendations, and described steps it had taken and/or planned to take to address them. The department did not state whether it concurred with GAO's recommendation to encourage state officials to consider involving state CIOs in Medicaid IT projects. HHS stated that it was unable to discern evidence as to whether a certain structure contributed to a specific outcome. GAO believes, consistent with federal law, that CIOs are critically important to the success of IT projects.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should develop formal procedures that include specific steps to be taken in the APD review process, including how CMS will document the review (including the name of the reviewer, date of review, and what was reviewed); what documentation should be retained after the review; as well as decision-making criteria for approval or denial decisions for state Medicaid IT funding requests. (Recommendation 1) |
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures (SOP) that included specific steps to be taken in the APD review process and the decision-making criteria for approval. For example, the SOP requires CMS to review APDs for completion of all required elements, the scope to ensure it matches the needs and objectives of the system, and that the total amount of funding is included in the request. In addition, the SOP also requires that CMS utilize its Medicaid Enterprise Systems Unified Workflow capability that tracks the review of the APD. For example, the workflow documents the name of the reviewer, the date of the review, and what was reviewed. The workflow also serves as a documentation management system that stores all of the documentation related to the APD and subsequent review.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should, as part of the APD review process and prior to approval, verify that all of the required information (e.g. alternatives analysis, feasibility study, and cost benefit analysis) is included in the funding request. (Recommendation 2) |
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that, as part of the APD review process and prior to approval, required reviewers to verify that all of the required information, such as an alternative analysis, feasibility study and cost benefit analysis, was included in the funding request.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should ensure that all APD-related artifacts are retained within the designated CMS document management system, including documentation of key information from meetings and email communications with the states, the MITA self-assessment and independent verification and validation reports, when creating APD decision packages. (Recommendation 3) |
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that required reviewers to store all APD-related artifacts within its designated CMS document management system, the Medicaid Enterprise Systems Unified Workflow. Further, the procedures identified steps regarding how CMS would validate that all documents were retained within the system.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should require analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle instead of individual APDs. (Recommendation 4) |
Closed – Implemented
As of July 2022, GAO verified that CMS developed standard operating procedures that required reviewers to maintain all APD-related artifacts within its document management system. The procedures also included instructions that required analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle, instead of individual APDs. For example, CMS's Unified Workflow captures the APDs, their review history, and related artifacts in one centralized system. The Unified Workflow also has the capability to link APDs and their related projects together by utilizing the parent/child feature. Lastly, CMS maintains a SharePoint page to store state portfolios, including APDs, which allows them to identify and track all active MMIS and E&E projects across the states.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should, in consultation with the HHS and CMS CIOs, develop a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to states to assist them in improving the performance of the systems, with consideration to those that are high-cost and performing poorly. (Recommendation 5) |
Open
As of January 2024, CMS officials stated that the agency is pursuing the development of a risk-based approach to Medicaid Enterprise System oversight. According to CMS, this approach will be a process for Medicaid IT investments to help optimize the level of oversight CMS applies to state systems development projects. This process will be integrated into the system advanced planning document review as well. According to CMS officials, they plan to have the process finalized by July 2025. As of February 2024, CMS officials stated that the proposed draft regulation that will include this process remains on hold due to the pandemic. GAO will continue to monitor the implementation of this recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects. (Recommendation 6) |
Open
As of January 2024, CMS officials stated that encouraging state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects is now part of their normal engagement activities with states. They also stated that CMS is currently in the process of drafting a memo to remind state Medicaid agencies that they are encouraged to include their state CIO in overseeing their IT projects. CMS is also planning to develop sub regulatory guidance in the form of a CMS information bulletin by March 2024 regarding system advanced planning document processing. As of February 2024, CMS stated that the agency will ensure that similar language regarding encouraging state CIOs to be included in IT project oversight is included in the new guidance. GAO will continue to monitor the implementation of this recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems. (Recommendation 7) |
Closed – Implemented
in April 2022, CMS issued new guidance for implementing its outcome-based certification process for MMIS and E&E systems. The guidance includes specific steps to be taken by CMS to oversee and assess the success of these systems. For example, according to the guidance, CMS state officers are required to review evidence, such as metrics that states collect and report to CMS, to determine whether the system is achieving the identified outcomes. Specifically, states must report annually to CMS state officers on key operational metrics, such as timely eligibility determinations or claims payment. If after the review, CMS state officers determine that the system does not meet certification requirements, the state officers will work with the state on remediation of the findings and next steps to ensure that problems are adequately addressed before determining a certification decision. By undertaking these efforts, CMS is better positioned to improve its oversight and make funding decisions for state systems to support the Medicaid program.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should establish documented procedures for how the results of the outcome-based certification process will be used for conducting oversight and making funding decisions. The procedures should include specific steps that CMCS will take to oversee individual state MMIS and E&E projects and how it will demonstrate that the steps have been taken. (Recommendation 8) |
Closed – Implemented
On May 24, 2023, CMS issued new guidance, effective immediately, for its outcome-based certification process for how the results of the outcome-based certification process for MMIS and E&E systems will be used for conducting oversight and making funding decisions. The guidance includes specific steps to be taken by CMS to oversee individual state MMIS and E&E systems and how it will demonstrate that the steps have been taken. For example, the guidance outlines CMS's approval process for MMIS and E&E systems and state development of corrective action plans for systems CMS determines are non-compliant. Specifically, the guidance states that during the approval process, CMS is required to review evidence, such as metrics that states collect and report to CMS that correspond to agreed-upon outcomes. Further, CMS is to review independent verification and validation contractor reports to determine whether the state is in compliance with conditions to approve enhanced funding. According to the guidance, CMS will not approve system operational expenditures if the state does not submit the required evidence demonstrating successful system performance. Finally, the guidance states that when CMS determines that the system is no longer compliant with conditions of enhanced funding, states are required to develop corrective action plans and timelines for remediation. The states are then required to provide their CMS state officer with ongoing monthly status updates on system performance to resolve outstanding issues. Subsequently, the state officer is to monitor project progress against the corrective action plan until the issue is resolved. By undertaking these efforts, CMS is better positioned to improve its oversight and make funding decisions for state systems to support the Medicaid program.
|
| Centers for Medicare & Medicaid Services | Prior to approving funding for MMIS and E&E systems, the Administrator of CMS should identify areas of duplication or common functionality, such as core MMIS modules, in order to facilitate sharing, leveraging, or reusing Medicaid technologies. CMS should share the results of the review with the state or territory requesting federal funding for a duplicative or similar project and take steps to encourage states to share, leverage, or reuse Medicaid technologies, where possible. (Recommendation 9) |
Open
In April 2023, CMS stated that the agency's reuse repository is available to states to share information about their systems projects and procurements. According to CMS, it relies on states to comply with existing guidance and requirements for reuse. Specifically, as one of the conditions for enhanced funding, states are required to "promote sharing, leverage, and reuse of Medicaid technologies and systems within and among states." According to CMS guidance, reuse can be accomplished through sharing artifacts, documents, services or systems, and code segments, among other things. As of February 2024, CMS officials stated that they plan to update their standard operating procedures to encourage CMS state officers to share information on potentially duplicative projects with states requesting federal funding for a similar project and take steps, as appropriate, to share, leverage, and reuse Medicaid technologies, where possible. GAO will continue to monitor the implementation of this recommendation.
|