DEPARTMENT OF HEALTH AND HUMAN SERVICES 
OFFICE OF INSPECTOR GENERAL 
WASHINGTON, DC  20201 
APR 11 2014 
TO:  Marilyn Tavenner 
Administrator 
Centers for Medicare & Medicaid Services 
Leon Rodriguez 

Director 

Office for Civil Rights 

FROM:  Brian P. Ritchie 
Acting Deputy Inspector General 
for Evaluation and Inspections 
SUBJECT: 	 Memorandum Report:  Offshore Outsourcing ofAdministrative Functions 
by State Medicaid Agencies, OEI-09-12-00530 
This memorandum report provides information about State Medicaid agencies' 
requirements for outsourcing administrative functions offshore.  Outsourcing occurs 
when Medicaid agencies enter into agreements with contractors to perform administrative 
functions.  Outsourcing can occur inside the United States (domestic outsourcing) or 
outside (offshore outsourcing).  In 2011, an Office oflnspector General (OIG) review 
found that one Medicaid agency was unaware that a contractor had sent electronic copies 
of Medicaid claims offshore for processing.  This Medicaid agency inquired whether OIG 
had information regarding how States regulate offshore outsourcing.  In response, we 
initiated the current study, obtaining information from all 56 Medicaid agencies regarding 
their requirements and practices for outsourcing administrative functions offshore.  This 
memorandum report summarizes the information we collected from those States. 
SUMMARY 
Only fifteen of fifty-six Medicaid agencies have some form of State-specific requirement 
that addresses the outsourcing ofadministrative functions offshore.  The remaining 
41 Medicaid agencies reported no offshore outsourcing requirements and do not 
outsource administrative functions offshore.  Among the 15 Medicaid agencies with 
requirements, 4 Medicaid agencies prohibit the outsourcing of administrative functions 
offshore and 11 Medicaid agencies allow it.  The 11 Medicaid agencies that allow 
offshore outsourcing of administrative functions each maintained Business Associate 
Agreements (BAAs) with contractors, which is a requirement under the Health Insurance 
Portability and Accountability Act (HIPAA).  Among other purposes, BAAs are intended 
to safeguard protected health information (PHI).  These 11 Medicaid agencies do not 
have additional State requirements that specifically address safeguarding PHI.  Page 2  Marilyn Tavenner and Leon Rodriguez 
 
 
Seven of the eleven Medicaid agencies that allow offshore outsourcing of administrative 
functions reported that they outsource offshore through subcontractors, but none reported 
sending PHI offshore. If Medicaid agencies engage in offshore outsourcing of 
administrative functions that involve PHI, it could present potential vulnerabilities.  For 
example, Medicaid agencies or domestic contractors that send PHI offshore may have 
limited means of enforcing provisions of BAAs that are intended to safeguard PHI.  
Although some countries may have privacy protections greater than those in the United 
States, other countries may have limited or no privacy protections. 
 
BACKGROUND 
 
The Medicaid Program  
Medicaid is a joint Federal and State program that provides health care coverage to  
low-income and medically needy populations, such as children, senior citizens, and 
people with disabilities. States administer the Medicaid program subject to Federal 
guidelines and policies established by the Centers for Medicare & Medicaid Services 
(CMS).1  For example, States establishwithin Federal parameterstheir own eligibility 
requirements, health care benefit packages for beneficiaries, and provider reimbursement 
rates. Medicaid agencies must cover acute and long-term care services that include, but 
are not limited to, inpatient and outpatient hospital services; laboratory and x-ray 
services; and nursing home facilities and home health care.2  In addition, Medicaid 
agencies may choose to cover optional services such as prescription drugs, durable 
medical equipment, and personal care services.3  
 
Medicaid Agencies Administrative Functions  
Medicaid agencies perform a variety of functions, usually through the integration of 
information technology (IT) or data systems, to support the administration of the 
Medicaid program.  Medicaid administrative functions include, but are not limited to:4  
   enrolling eligible individuals, 
   determining what benefits the Medicaid agency will cover,  
   determining how much the Medicaid agency will pay for covered benefits and 
from whom it will purchase services (i.e., fee-for-service and managed care 
plans), 
   having a system for processing claims from fee-for-service providers and making 
capitation payments to managed care plans,  
   monitoring the quality of the services that the Medicaid agency purchases,  
   ensuring that State and Federal health care funds are not spent improperly or 
fraudulently, 
   collecting program information and reporting it to CMS, and 
   resolving grievances from applicants, beneficiaries, providers, and health plans. 
                                                 
1 Social Security Act (SSA)    19011936, 42 U.S.C.   13961396v. 

2 42 CFR   440.210.  

3 42 CFR   440.220.  

4 See generally  SSA  1902(a), 42  U.S.C.   1396a(a). 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 3  Marilyn Tavenner and Leon Rodriguez 
 
 
Outsourcing of Medicaid Administrative Functions 
Although Federal law requires that each State designate a single State agency to 
administer the States Medicaid program,  Medicaid agencies have the authority to 
delegate or outsource their administrative functions to other State agencies and/or 
contractors.5, 6  Medicaid agencies may outsource by entering into agreements with 
contractors to perform specific administrative functions on a periodic or routine basis.  
These contractors may be private companies identified as covered entities,7 business 
associates,8, 9 or trading partners.10  
 
Medicaid agencies may outsource directly, i.e., through contractors, or indirectly, 
i.e., through subcontractors. Direct offshore outsourcing occurs when a Medicaid agency 
contracts with an offshore contractor. Indirect offshore outsourcing occurs when a 
Medicaid agencys contractor subcontracts to an offshore contractor.  In a 2006 report on 
45 State Medicaid agencies, the Government Accountability Office (GAO) found that at 
least one Medicaid agency directly outsourced offshore and at least one Medicaid agency 
indirectly outsourced offshore. GAO stated that such reporting may be understated 
because many Federal contractors and agencies did not know whether their domestic 
vendors transferred personal health information to other locations or vendors.11   
Moreover, the GAO report did not assess States compliance with existing HIPAA 
regulations. 
   
                                                 
5  SSA  1902(a)(5), 42  U.S.C.   1396a(a)(5).  
6 42 CFR   431.10. 
7 Covered entities are health plans, clearinghouses, and  providers that electronically transmit PHI.  
Examples of PHI include a beneficiarys name, Medicaid number, billing  transactions, and date of birth.   
PHI can  be transmitted in electronic, oral, or paper formats.  The HIPAA Privacy Rule provides Federal 
safeguards to  maintain the privacy of PHI.  Health plans, including Medicare and Medicaid, provide or pay 
for the cost of health care.  Clearinghouses process and convert health information from one format to  
another.   Health care providers include physicians and pharmacies that electronically submit PHI for 
financial or administrative transactions, such as beneficiary claims.  45 CFR  150.103. 
8 Business associates are persons or  organizations that perform certain functions involving the use or  
disclosure of PHI on  behalf of a covered entity.  Business associates are subject to the HIPAA Privacy 
Rule.  45  CFR  150.103. 
9  Covered entities and  business associates must have BAAs.  Covered entities are required to have BAAs 
for downstream outsourcingi.e.,  when the original  outsourcing contract is followed by one or more 
subcontracting arrangements.  In such cases, BAAs must establish the conditions under which downstream  
contractors may use and disclose PHI and must include the required  privacy safeguards.  45 CFR  
 150.103 and  165.504(e). 
10 Trading  partners are entities that transmit electronic health data to covered entities, business associates, 
providers/suppliers, and software vendors, or that receive such data.  Trading partners are subject to the 
HIPAA Privacy Rule.  
11 GAO,  Domestic and Offshore Outsourcing of Personal  Information in Medicare, Medicaid, and  
TRICARE, GAO-06-676, September 2006.   
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 4  Marilyn Tavenner and Leon Rodriguez 
 
Federal Requirements for Offshore Outsourcing  
There are no Federal regulations that prohibit the offshore outsourcing of Medicaid 
administrative functions.  CMS requires that Medicare contractors or subcontractors 
obtain written approval prior to performing system functions12  offshore.13 Although there 
are no similar requirements from CMS for Medicaid, CMS has issued guidance in 
accordance with the Affordable Care Act (ACA) stating that Medicaid agencies are 
permitted to provide payments to contractors operating offshore for tasksincluding 
administrative functionsthat support the administration of the Medicaid program.14, 15  
 
METHODOLOGY 
 
We conducted an electronic survey of all 56 Medicaid agencies.16  In May 2013, we 
asked these agencies (1) whether they had any policies, Executive Orders, State laws, or 
contract requirements (collectively, requirements) that addressed the outsourcing of 
administrative functions offshore17 and (2) whether they directly or indirectly outsourced 
administrative functions offshore.   
 
For Medicaid agencies with outsourcing requirements, we asked whether the 
requirements included provisions specifically addressing PHI and whether the Medicaid 
agencies monitor contractors compliance with the outsourcing requirements.  We  
requested their requirements and BAAs, and we reviewed the requirements to identify the 
type or form of the requirement.  For the Medicaid agencies that outsource administrative 
functions offshore, we asked what types of administrative functions are outsourced 
offshore.  In June 2013, we conducted telephone interviews, as needed, with selected 
Medicaid agencies to clarify survey responses, and in some cases, we clarified 
inconsistent survey responses via email.   
 
This study was  conducted in accordance with the Quality Standards for Inspection and 
Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency. 
 
                                                 
12 Medicare system functions include, but are not limited to, the transmission  of electronic claims, receipt 
of remittance advice, or any system access to obtain beneficiary PHI and/or eligibility information. 
13  Medicare Fee For Service Standard  Companion Guide, page 18.  Accessed at 
http://www.medicarenhic.com/edi/download/J14%20PART%20B%20Medicare%20FFS%205010A1%20C 
ompanion%20Guide.pdf on May 25, 2012.  Appendix A, CMSR High Impact Level Data, Section SA-9.  
Accessed at http://www.cms.gov/informationsecurity/downloads/ARS_App_A-CMSR_HIGH.pdf on  
May 25, 2012. 
14 ACA, P.L. No. 111-148,  6505.  
15 Although Medicaid agencies cannot pay for health care benefits or  services to any entity located  offshore 
or  provided by offshore providers, payments  for administrative functions are permitted. CMS, State 
Medicaid Directors Letter #10-026, December 2010.  
16 Medicaid agencies include those in the District of Columbia, the Commonwealth  of Puerto Rico, the 
United States Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana 
Islands.  
17 We sent letters to each State Medicaid Director requesting contact information for the  person  or persons  
knowledgeable about whether the agency outsources administrative functions offshore.  We then sent  the 
survey to those contacts.  In some cases, State Medicaid Directors identified themselves as the appropriate 
contact. 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 5  Marilyn Tavenner and Leon Rodriguez 
 
RESULTS 
 
Fifteen Medicaid agencies have requirements addressing the offshore outsourcing of 
administrative functions 
Only one-quarter (15 of 56) of Medicaid agencies reported having some form of 
requirement addressing the offshore outsourcing of Medicaid administrative functions.  
Of those 15 Medicaid agencies, 11 have requirements that allow such offshore 
outsourcing. Nine of the eleven Medicaid agencies have requirements that allow offshore 
outsourcing with very few restrictions, and 2 of the 11 have requirements that allow 
offshore outsourcing only under limited circumstances.  The remaining 4 of the 
15 Medicaid agencies have requirements that prohibit the offshore outsourcing of 
administrative functions.  None of the 41 States without such requirements reported 
outsourcing Medicaid administrative functions offshore.   
 
Nine Medicaid agencies have requirements allowing offshore outsourcing with very few 
limitations. Among the nine Medicaid agencies that allow offshore outsourcing with 
very few limitations, three agencies addressed offshore outsourcing through Executive 
Orders, State laws, or a Medicaid agency policy manual.  The remaining six Medicaid 
agencies addressed offshore outsourcing through contract provisions.  All nine Medicaid 
agencies allow indirect offshore outsourcingi.e., they allow their direct contractors to 
have offshore subcontractors. Two of these Medicaid agencies also allow direct offshore 
outsourcing, in which the Medicaid agency contracts with offshore contractors for 
administrative functions.  Two other Medicaid agencies allow indirect offshore 
outsourcing, but specifically prohibit direct offshore outsourcing.  (Table 1 shows details 
on the nine agencies that allow offshore outsourcing with very few limitations.) 
 
According to the requirements that these nine Medicaid agencies have in place, the 
agencies must approve any contractor requests to outsource administrative functions 
offshore. Among the nine Medicaid agencies, views and practices regarding offshore 
outsourcing variedsome reported that they outsource offshore on a case-by-case basis, 
some reported giving preference to domestic contractors, and some  reported that they  
generally do not view the offshore outsourcing of administrative functions any differently 
than they view domestic outsourcing. 
 
   
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 6  Marilyn Tavenner and Leon Rodriguez 
 
Table 1: Description of Nine Medicaid Agencies Requirements Allowing Offshore  
Outsourcing of Administrative Functions with Very  Few Restrictions  
 
 
 
Description    Does the 
Description of 
Form of  of the  Does the  State monitor 
State Medicaid  requirement18   the requirement  requirement  requirement  contractor 
agency   for direct  
  for indirect   specifically   compliance 
offshore 
offshore  address  with the 
outsourcing  
outsourcing   PHI?  requirement? 
 
 
Florida   State law19   No requirement   Allows   No  Yes  
          
 
Contract 
Massachusetts   provisions  No requirement   Allows   No  Yes  
           
 
Contract 
Mississippi   provisions  No requirement   Allows   No  Yes  
           
 
Contract 
Montana   provisions  Prohibits  Allows   No  Yes  
           
 
Contract 
New Mexico  provisions  Prohibits  Allows   No  Yes  
           
           
  Contract         
North Dakota   provisions  No requirement   Allows   No  Yes  
   
           
  Executive         
Pennsylvania  Order20   Allows   Allows   No  Yes  
  
           
  Contract         
Rhode Island   provisions  No requirement   Allows   No  Yes  
   
           
  Medicaid Policy          
Tennessee   Manual  Allows   Allows   No  Yes  
 
   
 
The nine Medicaid agencies did not have offshore outsourcing requirements that 
specifically addressed the safeguarding of PHI.  Instead, these nine Medicaid agencies 
require contractors and subcontractors to have BAAs complying with HIPAA 
requirements for the protection of PHI. HIPAA requires that BAAs specify the 
contractors responsibilities for safeguarding PHI, the circumstances under which PHI 
                                                 
18 In their contract provisions, Medicaid agencies may reiterate and/or expand on the requirements they 
have already specified elsewhere (e.g., in Executive Orders, State law, and Medicaid policy  manuals).  
19  The  Medicaid agency  allows indirect offshore outsourcing for managed  care organizations and prepaid 
health  plans;  however, certain statutory and/or contractual restrictions exist.  For example, contract 
provisions may require that some administrative functions be performed in  a domestic location. 
20 Contractors must identify during the procurement process whether they or any subcontractor  will perform  
administrative functions offshore.  During the selection of contractors, the State may give  additional 
consideration to contractors that will perform services within the United  States.  
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 7  Marilyn Tavenner and Leon Rodriguez 
 
may be used and disclosed, and the requirements for reporting PHI violations or 
breaches. However, for all nine agencies, BAAs did not specifically address the offshore 
outsourcing of administrative functions involving PHI.  If Medicaid agencies engage in 
offshore outsourcing of administrative functions that involve PHI, it could present 
potential vulnerabilities.  For example, Medicaid agencies or domestic contractors who 
send PHI offshore may have limited means of enforcing provisions of BAAs that are 
intended to safeguard PHI. Although some  countries may have privacy protections 
greater than those in the United States, other countries may have limited or no privacy 
protections to support HIPAA compliance.   
 
All nine Medicaid agencies reported that they monitored contractors to ensure 
compliance with the agencies requirements on offshore outsourcing.  Although some of 
these Medicaid agencies reported that they directly monitor subcontractors, other 
Medicaid agencies reported that they rely on contractors to monitor subcontractors.  
Examples of monitoring activities reported by the nine Medicaid agencies included 
approving contractors requests to subcontract; conducting ongoing reviews of 
contractors and/or subcontractors policies and procedures; and requiring performance 
reports from contractors. These activities may vary based on the scope of the contract. 
 
Two Medicaid agencies have requirements allowing offshore outsourcing only under 
limited circumstances. Two Medicaid agencies addressed offshore outsourcing through 
an Executive Order or a State law. As shown in Table 2, both of these Medicaid agencies 
allow offshore outsourcing directly and indirectly.  
 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 8  Marilyn Tavenner and Leon Rodriguez 
 
Table 2: Description of Two Medicaid Agencies Requirements Allowing Offshore 
Outsourcing of Administrative Functions Only Under Limited Circumstances  
       
Description 
Description  Examples of  Does the  Does the 
of the 
State  of the  circumstances  requirement  State monitor 
Form of  requirement 
Medicaid   requirement21    for direct   requirement  under which  specifically   contractor 
agency   for indirect   offshore  address  compliance 
offshore 
offshore  outsourcing is   PHI?  with the 
outsourcing  
outsourcing   allowed  requirement? 
   
Contractor or   
subcontractor   
must meet one of    
four conditions,   
such as providing   
a unique service   
    that is mandatory   
    for the State to      
  Executive    purchase     
Missouri  Order22   Allows   Allows     No  Yes  
           
           
   
The function or   
service cannot be   
provided by    
New   domestic   
Jersey   State law  Allows   Allows   contractor or  No  Yes  
        subcontractor    
           
Source: OIG analysis of State survey responses and regulations, 2013. 
 
One Medicaid agency reported that State agencies must award contracts to domestic 
contractors unless certain circumstances existfor example, the contractor or 
subcontractor provides a unique service that is mandatory for the State agency to 
purchase. The second Medicaid agency reported that all contracts awarded by the State 
must be performed domestically except when the contracted services cannot be provided 
within the United States.  In such cases, the contractor and subcontractor must specify  
why these services cannot be performed domestically.  Both Medicaid agencies reported 
that they must approve offshore outsourcing contracts.  For more information about the 
two Medicaid agencies regulations, see the Appendix. 
 
Similar to the nine Medicaid agencies that allow offshore outsourcing with very few 
limitations, these two Medicaid agencies do not have requirements that specifically 
address PHI. However, these two Medicaid agencies include requirements to protect PHI 
in BAAs with all contractors and subcontractors.  In both States, the Medicaid agency 
contractors must also have BAAs with their respective subcontractors that include similar 
requirements for protecting PHI. 
 
Both Medicaid agencies reported monitoring contractors and subcontractors.  For 
example, one of the Medicaid agencies reported that all contract requirements are 
monitored for compliance by the contract administrator and by the State agency 
responsible for oversight of State contracts. 
                                                 
21 As noted in  Footnote 18, Medicaid agencies may use contract provisions to  reiterate and/or expand on 
 
requirements they have already specified elsewhere. 

22 Contractors must disclose the location where all services are performed.  

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 9  Marilyn Tavenner and Leon Rodriguez 
 
Four Medicaid agencies have requirements prohibiting offshore outsourcing. Of the four 
Medicaid agencies with requirements  prohibiting the offshore outsourcing of 
administrative functions, three rely on Executive Orders that prohibit such outsourcing 
and one relies on contract provisions that prohibit it.  All four Medicaid agencies reported 
monitoring contractors and subcontractors to ensure compliance with the agencies 
regulations. For example, contractors and subcontractors sign attestations of compliance 
with the Medicaid policies, disclose the location where all work is performed, and/or 
provide the primary place of business for the contractor or any subcontractor. 
 
Seven Medicaid agencies reported currently outsourcing Medicaid administrative 
functions offshore  
Seven of the fifty-six Medicaid agencies reported that they currently outsource 
administrative functions offshore; all seven of these have requirements allowing offshore 
outsourcing. As shown in Table 3, all seven Medicaid agencies indirectly outsource 
offshore, and one of the seven also directly outsources offshore. 
 
Table 3: Description of the Seven Medicaid Agencies Practices for Outsourcing  

Administrative Functions Offshore   

   
  Examples of 
State Medicaid  Form of requirement   administrative functions  Type(s) of offshore 
agency     outsourced offshore   outsourcing  
     
   
Florida   State law  IT  Indirect 
     
 
 
Massachusetts   Contract provisions  IT  Indirect 
       
 
  No specific types or 
Mississippi   Contract provisions  examples   Indirect 
       
   
  No specific types or 
Missouri  Executive Order   examples   Direct and indirect 
       
   
  No specific types or 
Montana   Contract provisions  examples   Indirect 
       
 
North Dakota   Contract provisions  IT  Indirect 
       
 
Rhode Island   Contract provisions  IT  Indirect 
       
Source: OIG analysis of State survey responses and regulations, 2013. 
 
Four of the seven Medicaid agencies reported that the most common type of 
administrative function that is outsourced offshore relates to IT.  For example, a 
Medicaid contractor in one State reported that it outsourced the Medicaid Management 
Information System (MMIS) implementation projects to offshore programmers and 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 10  Marilyn Tavenner and Leon Rodriguez 
 
software developers.23  In another State, a domestic contractor used offshore 
subcontractors to help develop and design a new claims processing system for the 
Medicaid agency.  In this instance, the offshore subcontractor designed programming and 
systems testing for this new system.  The remaining three Medicaid agencies did not 
report any common type of administrative functions that are outsourced offshore.  
 
All seven Medicaid agencies reported that they do not outsource offshore any 
administrative functions involving PHI.  In fact, some of these seven Medicaid agencies 
reported that for administrative functions involving PHI, they strongly prefer to outsource 
only domestically.  For example, one of the seven Medicaid agencies explicitly reported 
denying all requests to send offshore any administrative functions involving PHI. 
 
CONCLUSION 
 
This memorandum report provides information about the current Medicaid environment 
for outsourcing administrative functions offshore.  As of June 2013, 15 of 56 Medicaid 
agencies had some form of State-specific requirments that addressed offshore 
outsourcing. The remaining 41 Medicaid agencies reported no offshore outsourcing 
requirements and do not outsource administrative functions offshore.  Among the 
15 Medicaid agencies with requirements, 4 Medicaid agencies prohibit the outsourcing of 
administrative functions offshore and 11 Medicaid agencies allow it.  The 11 Medicaid 
agencies that allow offshore outsourcing of administrative functions each maintain BAAs 
with contractors, which is a requirement under HIPAA.  Among other things, BAAs are 
intended to safeguard PHI. These 11 Medicaid agencies do not have additional State 
requirements that specifically address the safeguarding of PHI.  Seven of the eleven 
Medicaid agencies reported outsourcing offshore through subcontractors, but none 
reported sending PHI offshore. If Medicaid agencies engage in offshore outsourcing of 
administrative functions that involve PHI, it could present potential vulnerabilities.  For 
example, Medicaid agencies or domestic contractors who send PHI offshore may have 
limited means of enforcing provisions of BAAs that are intended to safeguard PHI.  
Although some countries may have privacy protections greater than those in the United 
States, other countries may have limited or no privacy protections. 
 
This report is being issued directly in final form because it contains no recommendations.  
If you have comments or questions about this report, please provide them within 60 days.  
Please refer to report number OEI-09-12-00530 in all correspondence.   
                                                 
23 MMIS is a claims processing and information retrieval system for Medicaid.  All Medicaid agencies 
operate an MMIS to support program administration and maintain information, such as provider enrollment  
and claims processing.  Medicaid agencies may use a contractor to operate their MMIS.  42 CFR pt. 433. 
 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 11  Marilyn Tavenner and Leon Rodriguez 
 
APPENDIX:  STATE REQUIREMENTS FOR TWO MEDICAID AGENCIES 
THAT ALLOW OFFSHORE OUTSOURCING OF ADMINISTRATIVE 
FUNCTIONS UNDER LIMITED CIRCUMSTANCES  
 
State of Missouris Executive Order 
 
 
 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 12  Marilyn Tavenner and Leon Rodriguez 
 
APPENDIX (continued) 
 
 
 
 
 
 
 
 
 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)   Page 13  Marilyn Tavenner and Leon Rodriguez 
 
APPENDIX (continued) 
 
State of New Jerseys State Law 
 
Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)