Granting CMS direct access to the state's evidence repository is the preferred method for making evidence available to CMS. If that is not possible, the state may make other secure arrangements with CMS, such as using encrypted File Transfer Protocol (FTP). It is critical to follow all Health Insurance Portability and Accountability Act (HIPAA) regulations when submitting evidence that contains personal health information (PHI) and personally identifiable information (PII).