Frequently Asked Questions

Yes. The rules pertaining to procuring IV&V contracts (State Medicaid Director Letter 16-010) apply to both E&E and MMIS.

FAQ ID:95061

In most cases once they are created, the documents will simply be updated to account for the additional modules being planned or developed. A new document is not necessarily created for each module. If a state calls a document by a different name, the state should inform CMS of the name difference.

FAQ ID:95076

Granting CMS direct access to the state's evidence repository is the preferred method for making evidence available to CMS. If that is not possible, the state may make other secure arrangements with CMS, such as using encrypted File Transfer Protocol (FTP). It is critical to follow all Health Insurance Portability and Accountability Act (HIPAA) regulations when submitting evidence that contains personal health information (PHI) and personally identifiable information (PII).

FAQ ID:95081

No. Only the checklists pertaining to the modules undergoing review need to be included, and that only for the report created in preparation for a milestone review. However, the IV&V progress report should include risks and recommendations for the entire project--not just those about to undergo a milestone review.

FAQ ID:95086

When streamlining the core checklists (IA, TA and S&C checklists), we found that some criteria fit better in other checklists, so they were moved. To keep traceability simple for the states, we chose to keep the original identifiers for any criteria that were moved. The same holds true for criteria moved to the programmatic tab of the IV&V progress report template.

FAQ ID:95091

No, E&E systems are not subject to certification. Though the Medicaid Eligibility and Enrollment Toolkit (MEET) was based on the MMIS toolkit, the MEET was created as a way to align how CMS reviews Medicaid enterprise systems and is a means for CMS to provide technical assistance to the states.

FAQ ID:95096

MARS-E 2.0 compliance is not required by CMS for states' MMIS, but CMS recommends that states follow applicable national privacy and security standards and practices for their MMIS. MARS-E 2.0 compliance is required for states' Medicaid/CHIP Eligibility and Enrollment (E&E) systems in order to maintain their Authority to Connect with CMS. Link for more information about MARS-E 2.0: https://www.medicaid.gov/federal-policy-guidance/downloads/cib-09-23-2015.pdf (PDF, 105.5 KB).

FAQ ID:94871

For E&E and MMIS, enhanced FFP funding is available at 90 percent via the usual Advanced Planning Document process.

FAQ ID:94876

CMS encourages states to reuse modular solutions as much as possible. If a state can reuse a modular solution from another state with minimal changes or customization, CMS will work with the state to streamline the certification process as much as possible to leverage knowledge of the reused solution. However, CMS will still require a certification decision for each state implementation of reused solutions to ensure compliance with federal regulations.

FAQ ID:94896

All the criteria in the checklists (MITA, MMIS or Custom) are the same. The difference between checklists is the criteria organization within the checklists. If the services solution is innovative, unique, or an unconventional approach, then the custom checklist approach might be appropriate. The RO will work with the state and vendors to decide which checklist set is best suited for the state's certification. Both service and traditional-type solutions need to meet all certification criteria to ensure compliance with federal regulations.

FAQ ID:94901