Frequently Asked Questions

Under section 438.370, the enhanced match of 75 percent is available for the EQR-related activities described in section 438.358 if all of the following conditions are met:

• The EQR activity is performed on a managed care organization (MCO) by an entity meeting the requirements of a qualified EQRO in section 438.354 or its subcontractor;
• The activity is performed pursuant to a contract approved by CMS; and
• The activity is performed in accordance with a protocol issued by CMS.

FFP at the 50 percent matching rate is available for mandatory and optional EQR-related activities for PIHPs, PAHPs, and affected PCCM entities, regardless of whether the activities were conducted by an EQRO or another entity. FFP at the 50 percent matching rate is also available for EQR and related activities performed for MCOs that are conducted by an entity that is not a qualified EQRO. This is a change from previous regulations, under which the enhanced match was available for EQR of PIHPs to the same extent as MCOs. This provision took effect May 6, 2016.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:94646

Regardless of whether an EQRO contract is approved before or after May 6, 2016, the change in FFP for EQR-related activities was effective May 6, 2016 for expenditures incurred by the state on or after May 6, 2016. Per general CMS-64 claiming principles, a state incurs an expenditure that may be claimed on the CMS-64 on the date the state pays the EQRO for the completed performance of the contracted EQR-associated activity.

The change to the FFP match rate for expenditure reporting takes effect in the middle of a quarter, which means that states must ensure that claims for expenditures for EQR activities affected by the change in FFP which were paid before May 6th and claims for expenditures which were paid on or after May 6th are reported separately. For only the quarter ending June 30, 2016, the CMS-64 EQRO Line 17 will allow states to report state expenditures associated with PIHP EQRO activities paid prior to May 6, 2016 and claim the enhanced 75 percent match. State expenditures associated with PIHP EQRO activities paid on or after May 6th must be claimed at the 50 percent matching rate.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:94651

CMS expects to first issue revised protocols for the current mandatory and optional EQR-related activities in the Fall of 2017. We expect to issue the protocol for the new mandatory EQR activity relating to the validation of network adequacy later in 2017 or early 2018. States will have up to one year from the publication of the protocol to implement the new mandatory EQR activity.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:94656

For questions related to state expenditure reporting and claiming instructions for EQR activities, please contact your CMS regional office financial representative. For specific external quality review questions, including what activities qualify for enhanced match, please contact the Division of Quality and Health Outcomes at ManagedCareQualityTA@cms.hhs.gov.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:94666

Yes. CMS acknowledges that states may have legitimate reasons to set capitation rates for a time period that differs from 12 months and will take unusual circumstances into account when reviewing compliance with the rating period duration requirements. CMS will approve a rating period other than of 12 months when a state transitions the contract term and rating period from a calendar year to a state fiscal year basis and setting capitation rates for a 6 month or 18 month period would facilitate that transition. There may be other reasonable justifications for such variations in the rating period that CMS would be open to considering. The rationale for a rating period that differs from 12 months as defined in the regulation in section 438.2 should be specified in the rate certification required in section 438.7 for such consideration.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:93456

The implementation date for non-risk PIHPs and PAHPs, PCCMs, and PCCM entities for provisions tied to a rating period is the earliest date that a risk-based MCO, PIHP, or PAHP would need to comply. For example, the provisions in subpart F relating to appeals and grievances have an implementation date for risk-based contracts of the rating period for contracts starting on or after July 1, 2017. Non-risk PIHPs and PAHPs would need to implement those provisions by July 1, 2017.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:93461

The regulation at section 438.3(m) has a general reference to "generally accepted accounting principles" and "generally accepted auditing principles." This means that states have the flexibility to specify the applicable generally accepted accounting and auditing principles for the audited financial reports in the managed care plan contracts. The federal regulation does not endorse a particular standard.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 185.26 KB)

FAQ ID:93466

State laws determine what information is required of the health plans. A health plan's disclosure and use of information that is required to be submitted under state law - such as, information from insurer eligibility files sufficient to determine during what period any individual may be, or have been, covered by a health insurer and the nature of the coverage that is or was provided by the health insurer — is consistent with the HIPAA privacy provisions.

Under HIPAA, both the state Medicaid agency and most health insurers are covered entities and must comply with the HIPAA Privacy Rule in 45 CFR Part 160 and Part 164, Subparts A and E. In their capacities as covered entities under HIPAA, the state Medicaid agency and health insurers are restricted from using and disclosing protected health information (PHI), as that term is defined in 45 CFR section 160.103, other than as permitted or required by the HIPAA Privacy Rule. However, as relevant here:

1. A covered entity may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of the law. (45 CFR 164.512(a)(1)) Under this provision, each covered entity must be limited to disclosing or using only the PHI necessary to meet the requirements of the law that compels the use or disclosure. Anything required to be disclosed by a law can be disclosed without violating HIPAA under the "required by law" provisions. Therefore, health insurers may disclose data elements in addition to the four minimum data elements, up to and including submission of an entire insurer eligibility file, to the extent such information is required to be submitted by state law. (45 CFR 164.512(a))
2. Separately, a covered entity may use or disclose PHI, without the consent of an individual, for payment activities, including to facilitate payment. (45 CFR 164.502(a)(1) and 164.506) Under HIPAA, the term payment includes activities undertaken by a health plan to determine or fulfill its responsibility for coverage and provision of benefits under the health plan. These activities include determinations of eligibility or coverage, adjudication or subrogation of health benefits claims, and collection activities. (45 CFR 164.501) To the extent plans are releasing this information to the Medicaid program for payment purposes; this is a separate basis for disclosure under HIPAA.
3. The HIPAA Privacy Rule generally requires covered entities to take reasonable steps to limit the use and disclosure of PHI to the minimum necessary to accomplish the intended purpose. (45 CFR 164.502(b)(1)) However, among other limited exceptions, the minimum necessary requirements do not apply to uses or disclosures that are required by law under 45 CFR 164.512(a).

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 252.32 KB)

FAQ ID:91216

Yes. There is a significant amount of third party coverage derived from health plans licensed in a different state than where the Medicaid beneficiary resides. This can commonly happen when the policyholder works in one state and lives in another state. For example, there may be policyholders who are enrolled in Medicaid coverage in Maryland, or have dependents that are enrolled, who work in Delaware, the District of Columbia, Pennsylvania, Virginia, or West Virginia and also have coverage through their employer in that state. This highlights the need for Medicaid agencies to obtain plan eligibility information from contiguous states in addition to collecting information in their respective state.

Another example is when Medicaid-eligible children are covered by the insurance plan of non-custodial parents who live in a different state than their child(ren). This example is not limited to contiguous states because non-custodial parents could reside in any state in the country. Depending on the size, it may be beneficial for the state to obtain the plan's entire eligibility file. The specific geographical areas to be included in the data exchange should be negotiated with the plans. We recommend use of a Trading Partner Agreement in the exchange of electronic data.

Finally, section 1902(a)(25)(I)(i) of the Social Security Act directs states, as a condition of receiving federal financial participation (FFP) for Medicaid, to have laws in effect that require health insurers doing business in their state to provide the state with the requisite information with respect to individuals who are eligible for, or are provided medical assistance, i.e., Medicaid beneficiaries. State law cannot reach beyond the entities that are "doing business" in their states.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 252.32 KB)

FAQ ID:91221

Yes. State Medicaid programs may enter into data matching agreements directly with third parties or may obtain the services of a contractor to complete the required matches. Such arrangements should comply with Health Insurance Portability and Accountability Act of 1996 (HIPAA)'s "Business Associate" requirements, where applicable. When the state Medicaid program chooses to use a contractor to complete data matches, including matches as required by the Deficit Reduction Act of 2005 (DRA), the program delegates its authority to obtain the desired information from third parties to the contractor.

Third parties should generally treat a request from the contractor as a request from the state Medicaid agency. Third parties may request verification from the state Medicaid agency that the contractor is working on behalf of the agency and the scope of the delegated work.

Supplemental Links:

• This FAQ was released as part of a larger set. View the full set. (PDF, 252.32 KB)

FAQ ID:91226