DEPARTMENT OF HEALTH & HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, Maryland 21244-1850 
Center for Medicaid and State Operations 
SMDL #02-005 
April 4, 2002 
Dear State Medicaid Director: 
The purpose of this letter is to provide you with assistance in your on-going activities to 
implement the Health Insurance Portability and Accountability Act's (HIPAA) 
Administrative Simplification (A/S) provisions.  Guidance on submitting a compliance 
plan to obtain a one-year delay in the compliance date until October 17, 2002, for the 
HIPAA Transaction Rule was sent in a separate letter (SMD #02-003) dated March 7, 
2002. 
Enclosed with this letter are two sets of documents.  One is titled "Electronic Data Interchange 
Transaction: HIPAA Readiness Checklist."  The other is a model Advance Planning Document 
(APD) designed to help expedite your requests for enhanced Federal financial assistance relative 
to HIPAA-related changes to your Medicaid Management Information System. 
HIPAA READINESS CHECKLIST 
This checklist was designed by experts to assist states in cataloguing the actions they have taken, 
and those they plan to take, to become HIPAA compliant.  It provides a set of useful benchmarks 
that can help gauge the degree of progress you have made to date, and the activities still 
remaining to be undertaken or completed.  This is a self-assessment tool designed specifically by 
and for state Medicaid agencies.  Should anyone on your staff need assistance regarding its use, 
they should contact their respective regional office Medicaid systems lead or Henry Chao, here 
in Baltimore, at (410) 786-7811, hchao@cms.hhs.gov. 
MODEL ADVANCE PLANNING DOCUMENTS FOR HIPAA 
Use of the enclosed model APD should significantly shorten the traditional APD process.  Its use 
is completely voluntary but we believe it will help focus both of our efforts on the most 
important issues which need to be aired.  It was designed with the help of state system staff who 
have had considerable experience in submitting APDs in the past, and we think this is a faster, 
better way to achieve mutually satisfactory results relative to systems changes needed under 
HIPAA.  Page 2  State Medicaid Director 
In all, this package contains the following documents: 
	 Attachment A: An APD Guidance Document.  This document provides details on the APD 
process, and appropriate sections of the regulations. 
	 Attachment B:  Appropriate sections of Part 11 of the State Medicaid Manual (SMM) 
provide detailed information on allowable costs. 
  Attachment C: Model HIPAA Planning APD 
  Attachment D:  Model HIPAA Implementation APD 
	 Attachment E:  State Medicaid Director letter dated December 5, 1995 clarifies policy 
regarding sole-source procurements. 
If your staff has any questions regarding the enclosed documentation, please have them contact 
your MMIS representative in your regional office, or Jason Goldwater of my staff, at 
(410) 786-0476. 
Sincerely, 
/s/ 
Dennis G. Smith 
Director 
Enclosures 
cc:

CMS Regional Administrators

CMS Associate Regional Administrators 
for Medicaid and State Operations 
State Chief Information Officer 
State HIPAA Coordinator 
William Davis 
Acting Director, Division of State Systems Policy

Administration for Children and Families

Joy Wilson

Director, Health Committee

National Conference of State Legislatures

Jennifer King

Director, Health and Human Services Task Force

American Legislative Exchange Council
 Page 3  State Medicaid Director

Lee Partridge

Director, Health Policy Unit

American Public Human Services Association

Brent Ewig

Senior Director, Access Policy

Association of State and Territorial Health Officials

Matt Salo

Director of Health Legislation

National Governors Association

Trudi Matthews

Senior Health Policy Analyst

Council of Governments
 Technical Support Services

for the Medicaid

HIPAA-Compliant

Concept Model

(MHCCM)

HIPAA EDI Transaction Risk Assessment Checklist

(For State Self-Assessment)

February 12, 2002

Prepared for:

Centers for Medicare & Medicaid Services

Center for Medicaid and State Operations

7500 Security Boulevard

Baltimore, MD 21244  1850
 HIPAA EDI TRANSACTION RISK ASSESSMENT CHECKLIST 
(STATE SELF-ASSESSMENT) 
The risk assessment checklist is provided as a self-assessment tool to allow States or agencies to gauge where they are in the 
overall picture of HIPAA implementation. This checklist is intended to be used by the HIPAA Coordinator, HIPAA Project Lead, or 
other key agency representative in the State, Medicaid agency, or other agency. Use of this checklist is voluntary; it is intended to 
assist the agency and is not required to be submitted to CMS. 
The Yes column following each item can be checked if the person completing it can respond positively to the question (i.e., the item 
is completed or in progress). The Yes column can also be checked if adequate resources and planning have been allocated for 
future efforts. If these criteria are not met, the No column should be checked. Two critical parameters often appear in the question 
sets. The first addresses whether a thorough analysis was performed resulting in a clear understanding of the task in question. The 
second addresses whether a firm commitment of specific allocation of funds and/or resources exists to accomplish the task. 
There are no official score sheets or right or wrong answers; the list of questions is provided as an aid to help establish a barometer 
of progress and highlight work still needing to be accomplished. The list is also intended to provide ideas on areas that States or 
agencies may not have considered in their project efforts toward HIPAA compliance. It is in the organizations best interest to answer 
the questions as honestly and accurately as possible. The HIPAA Project Lead or HIPAA Project Coordinator is usually in the best 
position to provide accurate answers to the questions and can act as the best judge of the status of each project area in the checklist. 
Each question for which a No answer was supplied should be examined, and the reason for which No was given should be 
understood. If, in fact the No answer is proper for the activities required to become HIPAA compliant, it need not be 
considered further and N/A can be put in the answer boxes. The checklist is intended to serve as a tool for identifying areas 
of risk. Every No answer remaining after the analysis is an indication of an area of risk. The more remaining Nos, the higher 
the risk for achieving HIPAA compliance. In general, the project is at low risk if the answers are mainly Yes or N/A. 
However, even in the case of many No responses to the questions, this checklist is not intended to give the impression that 
the organization is not going to successfully achieve HIPAA compliance. It should allow better focus of organization efforts 
in the time remaining until Oct. 16, 2003. 
Please be aware that this checklist only applies to the Transaction Standard  Rule 1. Rule 2, Privacy, must also be implemented in 
this time period. Activities pertaining to Rule 2 are not included in this checklist. 
The timeline graphic is based on the GAO guidelines for project implementation. It illustrates the overlapping of project phases and 
activities and the overall chronology of project activity. The timeline also provides comparison dates of January 2, 2002 and January 
2, 2003 to provide a general indication of where each organization should be in the project timeline. This is a depiction of an ideal 
project. Roughly, a HIPAA Project can correlate its own timeline to this one by aligning its actual start date with this timelines start 
date (October 16, 2000) and then comparing its tasks and activities with the timeline for the 10 defined project areas (A-J). 
Sources for useful HIPAA-related information are suggested in some of the checklist items below (CMS white papers can be found at 
either WWW.MHCCM.ORG or WWW.CMS.GOV). In addition, white papers on the WEDI-SNIP website (SNIP.WEDI.ORG) and the 
State NMEH representative can provide more information. 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 1  PLOTTING THE PROJECT TIMELINE

Testing must  Compliance Date 
begin no later  (On or Before 
than April 16,  October 16, 2003)
October 16, 2000  January 2, 2002  January 2, 2003 
2003 
Part A = HIPAA Project Office, Budgets, Resources, Contracts and Plans 
Part B = Definition of Covered Entity Status 
Part C = Coordination of State Medicaid (or Other Agency) Enterprise 
Part D = Impact on Medicaid (or Other Agency) Business 
Part E = System Impact Assessment 
Part F = Design of System & Business Process Changes 
Part G = System Renovation 
Part  H = Validation and Testing 
Part I = Implementation and  Transition 
Part J = Contingency Planning 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 2
 HIPAA EDI TRANSACTION RISK ASSESSMENT CHECKLIST  State Self-Assessment 
Checklist Contents  Page 
Part A  HIPAA Project Office, Budgets, Resources, Contracts and Plans  3

Part B  Definition of Covered Entity Status  5

Part C  Coordination of State Medicaid (or Other Agency) Enterprise  6

Part D   Impact on Medicaid (or Other Agency) Business Processes  7

Part E  System Impact Assessment  8

Part F  Design of System and Business Process Changes  10

Part G  System Renovation  10

Part H  Validation and Testing  11

Part I   Implementation and Transition  12

Part J  Contingency Planning  13

Part A  HIPAA Project Office, Budgets, Resources, Contracts, and Plans 
1. HIPAA Project Office (HPO) Established 
HPO can be statewide, agency or department specific. Responsibilities, structure, schedule, tracking, and reporting set 
up. For guidance, read the CMS paper GETTING ORGANIZED FOR HIPAA: States Best Practices for Scaling Mt. HIPAA 
Yes  No 
Is an HPO established? 
Does the HPO have a written charter and a defined role? 
Does the HPO have support at the highest State executive levels? 
Is there a current Organization chart and Charter document? 
Rev. 0
  STATE SELF-ASSESSMENT CHECKLIST  Page 3  2. HIPAA Budgets, Resources, And Contracts 
Resources identified and available 
Yes  No 
Are the HIPAA budget requirements known in detail? 
Are the needed APDs submitted and approved for HIPAA? 
Is there a resource plan? 
Are the staffing requirements assessed for the entire project? 
Are staffing resources available when needed? 
Does the HPO have a firm commitment of resources and staff to meet the requirements? 
Are all necessary RFPs for resources and staff completed? 
Are contracts in place for additional resources and staff? 
Are contracts in place for needed software (translators, for example)? 
Are other needed services and support contracts in place? 
3. State or Agency HIPAA Plan 
Overall State plan should include State agency coordination. May need sub-plans for specific areas, associated offices or 
subordinate departments (Project Management, Status/Tracking, Testing, Risk Management, Configuration 
Management, QA/QC, Contingency Planning, etc.) For help on the format and contents of system and software 
development related plans, see the IEEE Software Engineering Standards at WWW.IEEE.ORG. Lots of good software 
management related information, including Risk Management, is available from the Software Engineering Institute at 
WWW.SEI.CMU.EDU. 
Yes  No 
Is there an overall State or Agency (or comparable) HIPAA plan? 
If needed, are there individual department plans? 
Are reasonable timelines established for critical activities? 
Are specific individuals responsible for updating the plan? 
Does the plan include outreach activities? 
Is there a plan for implementation of future HIPAA rules (NPI, Transaction Version Changes, Plan 
ID, Claims Attachments)? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 4  4. Scheduling and Tracking Project Activities 
Tracking individual plans & schedules for renovation effort 
Yes  No 
Do HIPAA schedules define tasks and milestones, indicating responsible entities and 
dependencies? 
Is there a process and tools to support maintaining HIPAA project plans and schedules? 
Do all departments, divisions, and units report to the HPO on HIPAA progress? 
Is there periodic Executive level review of progress and deadlines? 
Has a request for a one-year implementation delay been submitted (by Oct 16, 2002)? 
Part B - Definition of Covered Entity Status 
5. Definition of Covered Entity Status 
Definition of Medicaid covered entity status and its relationship to other State agencies (Depts. of Health, Mental Health, 
Aging, etc.). For guidance, read the CMS paper ARE YOU A COVERED ENTITY? And When Does Rule 1 Apply? 
Yes  No 
Has the Medicaid State agency defined its own Covered Entity boundaries? 
Have any exempt components been identified? 
Does the agency have any components, (e.g., Provider role, Clearinghouse role, or Sponsor role) 
which would qualify it as another type of Covered Entity? 
Does the Medicaid agency know the Covered Entity status of the other State agencies with which it 
does business? 
Does the HIPAA Project Plan cover all relationships? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 5  Part C  Coordination of State Medicaid (or Other Agency) Enterprise 
6. Outreach To Trading Partners 
Inclusion of the State Medicaid Enterprise. For guidance, see the CMS paper OUTREACH TO DATA TRADING 
PARTNERS: Youre OK, Im OK 
Yes  No 
Does the agency have an Outreach Plan? 
Is the execution of the plan on schedule? 
Have issues related to testing with Partners been identified and resolved? 
Have transition issues been identified and resolved? 
Has the MHCCM (Medicaid HIPAA Compliant Concept Model) Enterprise Perspective been used to 
verify that all trading partners are included? 
7. Provider Survey 
Provider readiness indicator 
Yes  No 
Has a survey been sent to providers to determine their HIPAA readiness? 
Has the potential EDI volume been determined? 
Is the system able to handle all incoming data via all routes of data submission? 
8. Inventory Of Data Exchange Partners And Data Exchanged 
All covered exchanges should be known and classified as to transaction type 
Yes  No 
Was the Y2K inventory of data exchange partners and data reviewed and used as a starting point? 
Have the inventories been updated for HIPAA? 
For covered entities, have the data exchanges that require the use of standard transactions been 
identified? 
Is the opportunity to use any non-mandated standards (277 unsolicited, 275, 997) being 
considered? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 6  9. Trading Partner Agreements 
Assuring that Trading Partner agreements are updated for HIPAA 
Yes  No 
Have trading partner and Chain of Trust agreements been developed? 
Was a model agreement used? 
Was legal counsel involved in developing the contract language? 
10. Business Associate Agreements 
Assuring Business Associates are doing what is needed for compliance 
Yes  No 
Have all business associate contracts been examined in light of the Transaction rule? 
Are all needed parts of these contracts rewritten to ensure HIPAA compliance? 
Was a model contract used as an example? 
Was legal counsel involved in developing the contract changes? 
Part D  Impact on Medicaid (or Other Agency) Business Processes 
11. Business Process Identification, Review, And Re-Engineering 
Assessed for HIPAA impact, prioritized for re-engineering (requiring changes in policy, procedure, training and use of 
data) and for contingency planning 
Yes  No 
Have the business functions been inventoried? 
Has the inventory been verified against the business functions identified in the MHCCM Operations 
Perspective? 
Have the business processes been assessed for HIPAA impact? 
In particular, has the electronic availability of eligibility determination been assessed to determine 
required changes in day-to-day operations? 
Have the processes been prioritized for re-engineering? 
Have the processes been prioritized for contingency planning? 
Are specific plans in place for critical/top priority business processes? 
Can all impacted business processes be ready by the transition date? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 7  12. HIPAA Standard Code Sets (Loss of Local Codes) 
Identification and decisions on how to implement new standard codes, how to live without local codes, impact on systems 
which use local codes, impact on business processes. For guidance, see the CMS paper DATA CONTENTS AND CODE 
SETS: The Devil is in the Details 
Yes  No 
Has the impact of the loss of local codes and adoption of standard codes on business processes 
been assessed? 
Has the impact of the loss of local codes and adoption of standard codes on systems been 
assessed? 
Can required legal and policy changes to support the loss of local codes be implemented in a timely 
manner? 
Have needed requests for code set changes been submitted and coordinated with the NMEH sub-
workgroups (local codes, taxonomy, prior auth, EOB, etc.)? 
Is the impact that switching to standard codes will have on policies, procedures, retraining of staff, 
and communication with providers known? 
Part E  System Impact Assessment 
13. System Assessments 
Gap analysis, inventory of files, mapping of X12 transactions to internal formats, COTS analysis. See the MHCCM Toolkit 
for mapping and gap analysis support tools. 
Yes  No 
Has a Gap Analysis been performed? 
Have mandated standard HIPAA transactions been mapped (270, 271, 276, 277, 278 request, 278 
response, 820, 834, 835, 837, 837 COB)? 
Have all non-mandated X12 transactions that are planned to be implemented been mapped (e.g., 
277 UNSOLICITED, 275, 997)? 
Have all affected system components been identified? 
Has system assessment been completed? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 8  14.  Input Modes

Fax, paper, file, DDE, web-based, etc.  assure data elements available for later standard transactions, strip and store

(data element storage for later use) issues 
Yes  No 
Have all modes of input for all types of transactions been identified? 
Has a plan been developed to maintain or implement each type of input? 
Has the Medicaid position regarding all modes of input including DDE, web, etc. been documented? 
Have these positions and approach(es) been communicated to providers and other data trading 
partners? 
Has the completeness of the impact assessment been verified by using the MHCCM Operations 
Perspective section on Claims Submission? 
15. Systems Interfacing With The MMIS 
All systems that interface with the MMIS evaluated for impact. How to merge data from new and old claims. How to 
handle data warehouses with mixture of data types, etc. 
Yes  No 
Is there a master systems architecture diagram for the Medicaid enterprise? 
Does it include all the points of data exchange that may be impacted by HIPAA formatting or data 
standards? 
Have all interfacing systems been assessed for HIPAA impact? 
Are plans complete for the necessary modifications to the other systems? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 9  Part F- Design of System and Business Process Changes 
16. Solution Designed 
For MMIS and all other impacted systems  translation or clearinghouse decided upon. Access to historical claim data 
considered. 
Yes  No 
Has an overall approach to achieving compliance been decided upon and documented? 
Has the design of the compliant system been completed? 
Have needed software and system changes been detailed? 
Has a cleanup of master files (insurance, employer, provider, patient, etc.) been planned to insure 
error-free conversions of the data? 
If a translator and/or a clearinghouse are part of the solution, are their roles clearly and completely 
defined? 
Are strip and store (data element storage for later use) needs defined? 
Part G  System Renovation 
17. System and Software Solution Renovations 
MMIS modifications, translator, and clearinghouse interfaces developed & installed. Other Medicaid systems and SW 
renovations done. 
Yes  No 
Is there a schedule for design, development, and implementation? 
Are the system renovations prioritized? 
Is there a QA/QC function incorporated into the renovation process? 
Are the system renovations complete? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 10  Part H  Validation and Testing 
18. Test Plans

Test schedule, Test environments ready. For guidance on testing, read the CMS paper Testing! Testing! Do You Read Me?

Yes  No 
Is there an overall plan for testing? 
Does the test plan include translator, clearinghouse, provider and all other data exchange 
interfaces? 
Does the test plan include a representative sample of all data exchange partners? 
Does the plan provide for preparation and scheduling of a test facility or separate test environment? 
Is there a plan to certify the correctness of input/output systems? 
Is it planned to require that EDI providers demonstrate they have successfully tested? 
Is there a plan to certify EDI submitters? 
19. Testing

Testing of Renovated Software and Business Processes

Yes  No 
Is the use of a separate testing facility planned? 
Is there a test environment separate from operations? 
Is there an automated way to generate sample test data? 
Is there an automated method for running tests? 
Does the testing process include unit, system, integration and regression tests for all system 
changes? 
Do the planned tests address the following 6 levels of WEDI recommended testing: 
1) Integrity testing 2) Requirements testing 3) Numerical Balancing testing 4) Situation testing 5) 
Code Set testing 6) Type of Service/Product Type testing? 
Is there a system in place to record, prioritize and track test failures through to correction and 
retest? 
Is there a QA/QC function incorporated into the testing process? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 11  Part I  Implementation and Transition 
20.  Implementation Plan 
Implementation of the Renovated Systems 
Yes  No 
Is there a plan for implementing the renovated systems? 
If parallel operations are planned, are the resources in place? 
Are there plans to track and correct system problems identified during operations? 
Are there plans to implement modified business processes? 
Are there resources available to track process problems identified during operations? 
21. Transition Plan

Plans for the transition to HIPAA standard transactions

Yes  No 
Has phase-over or transition been planned? 
Does the plan include parallel operations? 
Have trading partners been informed of the transition plan? 
Are trading partners prepared to meet the dates in the transition plan? 
Has the plan been discussed with providers? 
Are providers prepared to meet the dates in the transition plan? 
Does the plan include enough time to test transactions thoroughly, and to phase in new standards 
before the beginning of the transition? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 12  Part J  Contingency Planning 
22. Contingency Plans

Based on business continuity needs, prioritization of business functions (pay claims), risk assessments.

Yes  No 
Is there a contingency plan in case all trading partners and providers have not completed transition 
by the end of the transition period? 
Is there a contingency plan in case the transition is not complete by the HIPAA deadline? 
Was the contingency plan based on plans developed for Y2K? 
Does the focus of the contingency plan reflect the critical business functions? 
Does the contingency plan identify how compliance with HIPAA will be achieved for transaction 
types that cannot be supported before the deadline? 
Are there plans and resources to test the contingency plan? 
Have the resources needed for contingency operations been identified? 
Are contingency operations resources available? 
Rev. 0  STATE SELF-ASSESSMENT CHECKLIST  Page 13
 Attachment A 
ADVANCE PLANNING DOCUMENT (APD) GUIDANCE 
DOCUMENT 
Part I  Background 
In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA) of 
1996 (P.L. 104-191) as a step toward reforming health care in the United States.  Title II, Subpart 
F of this law, titled "Administrative Simplification", requires that the Secretary of DHHS adopt 
standards necessary to create a national electronic health data system.  Standards are required for 
transactions and code sets, identifiers, data security, electronic signature data, and privacy.  The 
overall goal is to reduce administrative burdens in the health care industry by requiring and 
adopting the use of standardized, electronic transmission of essential administrative and financial 
data.  Additionally, Medicaid is a health plan.  As such, each states Medicaid Management 
Information System (MMIS) must comply with all provisions of each HIPAA rule.  The APD 
models (see Attachments C and D) and this Guide Document (Attachment A) have been 
designed to streamline the process for planning and implementing strategies for HIPAA. 
Funding 
The applicable regulations governing Federal Financial Participation (FFP) under title XIX are 
contained in 42 CFR 433.15, Subpart A.  FFP is available for statewide planning, design, 
development and installation (DDI) of mechanized claims processing and information retrieval 
systems, the MMISs.  FFP is available at the 90-percent rate for DDI ( section 1903(a)(3)(A)(i) 
and 42 CFR 433.15(b)(3); and at the 75-percent rate for the continued operation of such 
systems, approved by CMS (see section 1903(a)(3)(B); 42 CFR 433.15(b)(4)).  For further 
information regarding FFP, refer to the State Medicaid Manual, Part 11, sections 11276-11280. 
Part II Implementation and Planning Advance Planning Documents 
and Exemptions 
This section provides information on two APDs that are used to provide information regarding 
DDI and operational phases of system developments within a state Medicaid agency.  Both the 
Planning and Implementation APDs have similar requirements, but are used for different 
purposes.  The following section provides information regarding the overall intent and 
requirements for each document. 
Version 1: 04/04/2002  Page 1 
Health Insurance Portability and Accountability Act APD Guide  A. Planning Advance Planning Document 
The Planning APD is a brief document prepared and submitted prior to initiating 
planning phase activities.  The purpose is not to provide needs and plans in detail, but to 
develop a high-level management statement of vision, needs, objectives, plans and 
estimated costs.  The focus is on describing how planning will be accomplished and 
demonstrating that the state has established a plan that is reasonable for the level of effort 
of the project.  Planning APDs that meet the standards for approval as described below 
will be approved in sixty days.  The Planning APD has four sections: 1. Statement of 
Need; 2. Project Management Plan; 3. Planning Project Budget and 4. Assurances. 
1.  Statement of Need 
This section of the Planning APD should set forth the states information and services, 
vision, including the scope and objectives of the planned information system and its 
interrelationships with other systems (if known).  In addition, the needs statement should 
define the system requirements in terms of problems and needs listed.  The Model 
HIPAA Planning APD has three components under Statement of Needs.  They are: 
  Statement of Vision1  The APD must identify the overall strategy for 
reengineering MMISs to become compliant with the Administrative 
Simplification provisions of HIPAA.  Additional details can be provided, if 
necessary, to ensure that the system will become compliant by the deadline 
mentioned within each final rule. For example, the state may provide additional 
details to ensure compliance with the final rule on transactions and code sets for 
which the new deadline is October 16, 2003. 
  New or Changed Program Requirements  All provisions of each final rule must 
be mentioned in the states reengineering process.  Any differences between the 
states planned effort and the requirements must be explained. 
  Problems or Deficiencies in Existing System  The state must identify the 
deficiencies within the current MMIS that prevent overall compliance with the 
HIPAA final rules. 
2.  Project Management Plan 
The Project Management Plan summarizes how the states plan.  The states planning 
project organization is briefly described.  At this point in the project, all that is required is 
that the state identify, by name and title, key players in the planning phase, such as the 
project manager and other key planning staff.  This information can be depicted in an 
organizational chart. The Project Management Plan for planning describes how and 
1 Vision means the state planners view of future program needs and the system architecture necessary to support 
those needs. 
Version 1: 04/04/2002  Page 2 
Health Insurance Portability and Accountability Act APD Guide  when the activities for the planning phase will be conducted and schedules milestones for 
completion of key events.  This section consists of the following parts: 
	 Planning project organization (state and contractor) -- The state should provide a 
descriptive one-page chart and one-page of accompanying narratives describing 
the individuals working on the HIPAA project, their responsibilities, and 
relationships they have with state Medicaid staff and/or contractors responsible 
for HIPAA-related activities. 
	 Planning activities, products and deliverables  The state should summarize these 
in one page or less. 
	 Commitment to conduct: - Each state must check off whether they intend to 
conduct the following types of analyses.  A statement must be provided for any 
No box that is checked explaining the rationale behind why such analyses are 
not being conducted. 
	 Requirements Analysis (e.g. Gap Analysis)  The differences between current 
Medicaid systems and the HIPAA requirements.  Additionally, information on 
the resources and time needed to remediate the MMIS must be included. 
	 Alternatives Analysis  examining the potentiality of utilizing alternative 
methods as compared to the one chosen. 
	 Cost/Benefit Analysis  analyzing the initial and long-term costs during the 
remediation process and comparing them to the cost benefits of alternative 
methods. 
	 Joint Application Design (JAD) with users  whether a state will participate 
with the users of the MMIS in its remediation plan. 
	 Functional Specification  a detailed analysis of the functionality of the 
MMIS under HIPAA and whether it is consistent with the requirements 
outlined in the HIPAA final rules. 
  Systems Design  an analysis of how the MMIS will become HIPAA 
compliant and what technology will be employed. 
  Impact Assessment  an analysis of how compliance efforts will affect users 
of the MMIS. 
	 System Interrelationships (if applicable)  an analysis of the different 
relationships other applicable systems (e.g. IES) have with the MMIS, and 
how compliance efforts may affect them. 
3.  Planning Project Budget 
This section succinctly describes in narrative form the resource needs for which funding 
support during the Planning Phase may be requested by the state.  These needs may relate 
to state and contractor staff costs, computer time, hardware and commercially available 
software, travel space, supplies, telephones, photocopying and so forth.  This section of 
the APD provides the budget, projected costs and time schedule for the Planning Phase. 
Version 1: 04/04/2002  Page 3 
Health Insurance Portability and Accountability Act APD Guide  	 Anticipated state costs  The state must include documentation that anticipates all 
costs that would be included in both the development and implementation of the 
remediation method.  These costs must be broken down by fiscal quarter and 
summarized by fiscal year, including the totals for both project planning and the 
program as a whole. 
	 Proposed time schedule  The state must include documentation on the amount of 
time needed for the planning phase. 
4.  Assurances 
This section refers to the procurement of automated data processing equipment for 
mechanical claims processing, and whether it was procured under the appropriate 
requirements outlined in the Code of Federal Regulations listed, the appropriate sections 
of the State Medicaid Manual, and a State Medicaid Letter2 dated December 4, 1995. 
This section also refers to access to records, licensing, ownership of software and the 
safeguarding of information contained within the system. 
The state must indicate, through a check-box, whether they are compliant with the 
following provisions.  All No answers must be explained with complete justification 
provided. 
  Procurement Standards (Competition/Sole Source) 
Document:  Title 45 Code of Federal Regulations, Part 95 
Sec. 95.613 Procurement Standards. 
(a) Procurements of ADP equipment and services are subject to the procurement 
standards prescribed by Subpart P of 45 CFR Part 74 regardless of any conditions 
for prior approval. Those standards include a requirement for maximum practical 
open and free competition regardless of whether the procurement is formally 
advertised or negotiated. 
(b) Those standards, as well as the requirement for prior approval, apply to ADP 
services and equipment acquired by a state or local agency, and the ADP services 
and equipment acquired by a state or local Central Data Processing facility 
primarily to support the Social Security Act programs covered by this subpart. 
Service agreements are exempt from these procurement standards. 
Document:  State Medicaid Manual Part 11 
Section 11267 REQUIRED ASSURANCES 
2 The State Medicaid Letter, dated December 4, 1995 is attached to this Guide as ATTACHMENT E. 
Version 1: 04/04/2002  Page 4 
Health Insurance Portability and Accountability Act APD Guide  For 90-percent, as well as for 75-percent funding, and 50-percent FFP where the 
threshold amounts found at 95.611(a) are exceeded, give CMS, with respect to 
each RFP and/or contract entered into for a system, assurance that: 
Procurements of ADP services and/or equipment for mechanized medical claims 
processing and information retrieval systems meet the provisions of 45 CFR 74, 
Administration of Grants; 
Fair competition and public advertising are within Federal and state procurement 
standards.  The Federal procurement standards are in 45 CFR 74, Subpart P and 
the December 4, 1995 State Medicaid Director letter (See Attachment E). 
  Access to Records 
Document:  Title 45 Code of Federal Regulations, Part 95 
Sec. 95.615 Access to systems and records. 
In accordance with 45 CFR part 74, the state agency must allow the Department 
access to the system in all of its aspects, including design developments, 
operation, and cost records of contractors and subcontractors at such intervals as 
are deemed necessary by the Department to determine whether the conditions for 
approval are being met, and to determine the efficiency, economy and 
effectiveness of the system. 
Document:  State Medicaid Manual Part 11 
Section 11267 REQUIRED ASSURANCES 
For 90-percent, as well as for 75-percent funding, and 50-percent FFP where the 
threshold amounts found at 95.611(a) are exceeded, give CMS, with respect to 
each RFP and/or contract entered into for a system, assurance that: 
All deliverables, interim reports, data collection forms, questionnaires, and other 
working papers that support the final system acceptance will be made available on 
request to CMS.  This applies to the prime contractor, any subcontractors, and 
other state or local agencies supplying services. 
  Software Ownership, Federal Licenses and Information Safeguarding 
Document: Title 42 Code of Federal Regulations, Part 433 
Sec. 433.112(b) (5)  (9) 
Version 1: 04/04/2002  Page 5 
Health Insurance Portability and Accountability Act APD Guide  (5) The state owns any software that is designed, developed, installed or improved

with 90-percent FFP.

(6) The Department has a royalty-free, non-exclusive, and irrevocable license to

reproduce, publish, or otherwise use and authorize others to use, for Federal

Government purposes, software, modifications to software, and documentation

that is designed, developed, installed or enhanced with 90-percent FFP.

(7) The costs of the system are determined in accordance with 45 CFR 74.171.

(8) The Medicaid agency agrees in writing to use the system for the period of time

specified in the APD approved by CMS, or for any shorter period of time that

CMS determines justifies the Federal funds invested.

(9) The agency agrees in writing that the information in the system will be

safeguarded in accordance with subpart F, part 431 of this subchapter.

  Progress Reports 
Document:  State Medicaid Manual Part 11 
Section 11267  REQUIRED ASSURANCES 
For 90-percent, as well as for 75-percent funding and 50-percent FFP where the 
threshold amounts found at 95.611(a) are exceeded, give CMS, with respect to 
each RFP and/or contract entered into for a system, assurance that: 
Copies of progress reports, as requested, will be delivered to CMS. 
In addition to the four sections of the Planning APD described above, there is an 
additional provision at 45 CFR  95.605(vi), which requires a commitment to define the 
state's functional requirements for the purpose of evaluating the transfer of an existing 
system, including the transfer of another state's General Systems Design (GSD), which 
the state may adapt to meet state specific requirements. 
B. Implementation Advance Planning Document (APD) 
Implementation APDs are written plans of action that states use to request FFP in the 
designing, developing and implementing of the system.  States are required to submit an 
Implementation APD prior to incurring costs for system design and development when 
the total project costs (including planning) are estimated to exceed the thresholds in 45 
CFR  95.61(b).  The level of detail in the Implementation APD should be commensurate 
with the complexity and scope of the acquisition.  This template provides an overview of 
the requirements of an Implementation APD and emphasizes the need to keep the 
information tightly focused on the issues below.  Implementation APDs that meet the 
standards for approval will be approved within 60 days. 
Version 1: 04/04/2002  Page 6 
Health Insurance Portability and Accountability Act APD Guide  1.  Statement of Needs and Objectives 
In this section of the Implementation APD, the state should summarize the current 
environment and the new system needs, objectives, and anticipated benefits.  Needs may 
be expressed in terms of deficiencies in existing capabilities, new or changed program 
requirements, or opportunities for economies or efficiencies. 
  Statement of Needs and Objectives - The state must clearly state the purpose and 
objectives of the project to be accomplished and the necessity for the project.  A 
basic description of the modification or system utilized in order to make the 
MMIS HIPAA-compliant must be included. 
  Problems or deficiencies in existing system*3 - The state must describe why the 
current MMIS is unable to process the new or changed requirements listed in each 
HIPAA final rule. 
	 New or changed program requirements* - The state must explain any differences 
between the current MMIS and the requirements listed in each HIPAA final rule. 
2.  Requirements Analysis, Feasibility Study, and Alternatives Analysis 
The regulation at 45 CFR 95.605(2)(iii) provides for a requirements analysis, feasibility 
study, and alternatives analysis.  The regulation does not require that a "summary" of 
these analyses and study be a part of the Implementation APD, nor are copies of these 
documents required.  If the state has performed these analyses and study in the Planning 
APD, CMS will accept the Executive Summary of these documents as meeting the 
Implementation APD requirement. 
	 General Requirements  The state must submit a general requirements analysis 
for their compliance efforts, describing both the functional and technical needs, 
including system interface requirements, if applicable.  It should not exceed five 
pages in length, and should include all analysis completed up to the point of 
submission of the APD. 
  Alternatives Analysis  The state must briefly summarize which alternatives to 
the chose remediation effort were selected for evaluation of costs and benefits, 
and provide the rationale for selection of the chosen alternative. 
3.  Cost/Benefit Analysis 
The state must provide a summary of the results of the cost benefit analysis.  Program 
performance improvements, projected costs, and anticipated benefits the system is 
expected to deliver must be described succinctly.  The narrative should address the basis, 
3 *Not required if the State has submitted a HIPAA Planning APD 
Version 1: 04/04/2002  Page 7 
Health Insurance Portability and Accountability Act APD Guide  assumptions, calculations and measurement plan related to performance, cost and benefit 
goals.  The state must also indicate, through a check box, whether the following items are 
included with this analysis: 
a.	 Cost/Benefit Profile  A brief cost-benefit profile of the chosen method for 
HIPAA compliance must be included; 
b.	 Systems Life Benefits  A spreadsheet detailing the systems life of the chosen 
method of compliance must also be included. 
4. Project Management Plan 
The Project Management Plan summarizes the project activities, deliverables and 
products; project organization; state and contractor resource needs and anticipated system 
life.  If the state has previously submitted a Planning APD, any differences from the 
Project Management Plan submitted in that document must be explained. 
As succinctly as possible, the state must provide the following information: 
  A high-level workflow addressing project activities, milestones and contractor 
deliverables.  Relationships between activities, both sequential and parallel, 
must be established in the plan.  Additionally, responsibilities for staff must be 
included as well as provisions to check progress. 
  The project manager and other key staff must be identified by name and title. 
	 The relationship between the project team and the project steering committee 
must be identified (if applicable). 
  Interrelationships between the user group and contractors must be identified. 
  All resource needs for which funding support may be requested by the state 
must be identified.  These needs may relate to state and contractor staff costs, 
computer time, hardware and commercially available software, depreciation, 
travel, space, supplies, telephones, photocopying, office equipment, furniture, 
and so forth. 
	 A description of the anticipated system life for the required resources must be 
included.  This is inclusive of planning, implementation and operational 
phases. 
Version 1: 04/04/2002  Page 8 
Health Insurance Portability and Accountability Act APD Guide  5.  Proposed Project Budget 
The states proposed budget, summarized in this APD, considers all costs for 
implementation phase activities.  This might include, but is not limited to, costs 
associated with system software and data conversion, software development, computer 
capacity planning, contractor costs, supplies, training, maintenance and operations. 
Miscellaneous ADP costs may also be included. 
A state must include a summary of all implementation costs, by state and Federal shares. 
These must be broken down by phase, category and cost amounts.  Please refer to 
Attachment B for the sections of the State Medicaid Manual for additional guidance. 
6.  Assurances 
Please refer to Section IV under the Planning APD subpoint for information pertaining to 
this section. 
7.  Cost Allocation 
The prospective cost allocation plan is described, including procedures to identify, 
record, allocate, and report direct and indirect costs, partially and fully attributable to the 
system project. 
A state must include the following: 
  The rate of FFP, either enhanced or regular, by cost category per year; and 
	 A list of each phase of implementation, the program share of cost, the total 
amount, the FFP rate and the Federal/state shares. 
C. EXEMPTIONS 
For all systems-related activity having to do with compliance with the Administrative 
Simplification provisions of HIPAA, a Planning APD is not required.  A state may 
choose to submit only an Implementation APD as long as it meets the requirements 
outlined in this document.  Furthermore, we wish to confirm that the requirements of the 
Paperwork Reduction Act which, as a general matter, imposes a specific process for 
approval of documents requiring the collection of information, is not implicated. 
Version 1: 04/04/2002  Page 9 
Health Insurance Portability and Accountability Act APD Guide  Attachment B 
STATE MEDICAID MANUAL, PART 11, SECTIONS 11276-11280 
11276	 COSTS RELATED TO MMIS DESIGN, DEVELOPMENT, 
INSTALLATION, OPERATION, AND ENHANCEMENT 
11276.1  Introduction. 
FFP is available at either 90 percent or 75 percent, but may be paid only for those
functions attributable to an MMIS.  For example, with respect to provider enrollment,
only the costs of entering data into the computer system and processing computer
exceptions are reimbursed at 75 percent FFP.  Other functions, even if performed by the
same unit or individuals, are reimbursable at 50 percent FFP. Appropriate costs,
including overhead directly attributable to the operation of the system are also
reimbursable at 75 percent FFP. (See 11276.9.) 
45 CFR 74.1711 references OMB Circular No. A-87, which defines direct costs as "those 
that can be identified specifically with a particular cost objective.  Indirect costs are those 
(a) incurred for a common or joint purpose benefiting more than one cost objective, and
(b) not readily assignable to the cost objectives specifically benefited, without effort
disproportionate to the result achieved."  As explained below, only direct costs identified
specifically with the MMIS system may be claimed at the enhanced rate. 
11276.2  Costs Reimbursable at 90 Percent FFP 
FFP at 90 percent is available for costs directly attributable to the Medicaid program for
the design, development, installation, and enhancement of mechanized claims processing
and information retrieval systems. Included are resources needed for systems
requirements analysis, design definition, forms development, programming, unit testing,
integrated test, conversion, the use of hardware to the extent necessary for design,
development, and installation, and supplies for the above.  These and other direct costs 
including personnel costs of the State project management team specifically assigned for
the development and installation effort are included.  Other administrative activities are 
matched at 50 percent. 
11276.3  Costs Reimbursable at 75 Percent FFP 
FFP at 75 percent is available for MMIS operations and proprietary software. 
A.  MMIS Operations. 
FFP at 75 percent is available for direct costs directly attributable to the Medicaid
program for ongoing automated processing of claims, payments, and reports.  Included 
are forms, use of system hardware and supplies, maintenance of software and
documentation, and personnel costs of operations control clerks, suspense and/or
exception claims processing clerks, data entry operators, microfilm operators, terminal
operators, peripheral equipment operators, computer operators, and claims coding clerks 
1 Clarification of 45 CFR 74.171, though deleted after the SMM was issued, can be found in Attachment E 
of this Guidance package in a Dear State Medicaid Directors letter dated Dec. 5, 1995. 
Version 1  Page 1  04/04/2002  if the coded data is used in the MMIS, and all direct costs specifically identified to these
cost objectives.  Report users, such as staff who perform follow-up investigations, are
not considered part of the MMIS. 
FFP at the 75 percent level for operations does not cover clerical processing operations,
except as indicated.  One of the aims of system improvements is the mechanization of
front-end manual editing operations to achieve greater edit reliability and the reduction of
clerical workload. 
B.  Proprietary Software 
FFP at 75 percent is available for the license fee associated with proprietary software
being used to perform certain functions that are within the confines of an approved
MMIS; e.g. information retrieval and report generation  (See 11276.5 for Decision
Support System policy). 
Several regulatory factors govern such use, and are described in 45 CFR 95.617(c); 
(1)  Software packages sold or leased to the general public are not subject to the
ownership provisions normally applied to software developed with FFP (45 CFR
95.617(a) and (b), and 
(2)  FFP is not available for proprietary application software developed specifically
for the public assistance programs covered under this subpart, (in this case, the Medicaid
Program). 
Minimally, the proprietary application software must have applicability to the medical
environment/community at large, and be marketed/sold within that medical
environment/community at large. 
HCFA will approve the use of such proprietary software which; 
(a)  meets the above restrictions of 45 CFR 95.617(c), and, 
(b)  where the vendor of the proprietary software agrees, in writing, to grant
the State a perpetual license for continued use of the software should the State award a
contract for a subsequent take-over of the MMIS operations by another fiscal
agent/contractor. 
11276.4	 Costs Reimbursable at 90 and 75 Percent FFP for Equipment and Supplies
Rented or Purchased 
Purchase rather than rental of mechanized equipment must be justified by establishing
that it is to the economic advantage of the State and Federal governments after
consideration of the tangible and intangible factors involved.  Included in this 
determination is consideration of the alternative to lease the equipment with option to
purchase.  Equipment cost for its use during the design, development, and installation or
enhancement of an MMIS to assist in accomplishing these tasks is eligible for 90 percent
FFP. 
Equipment purchased for operational purposes is eligible only for FFP at 75 percent.
Cost of equipment used during both implementation and operation of an MMIS is
assigned by proration.  Depreciation or use allowance for State charges for equipment
cost is usual practice. (See 45 CFR 95, Subpart G.)  Approval requirements for
equipment acquisitions, when waiver is part of the APD, are found in 45 CFR 95.641. 
The FFP percentage for purchase of supplies depends upon the life and use of the item.
The portion of items consumed during design, development, and installation for system 
Version 1  Page 2  04/04/2002  test such as cards, microfilm, and forms (limited quantity) may be charged at 90 percent
FFP. The portion of items not consumed and partially used during design, development,
and installation may be charged at 90 percent FFP, and the remaining portion at 75
percent FFP.  These same items used during system operation must be charged at 75
percent FFP. 
Supplies purchased, such as disk packs and magnetic tapes, must be charged at 75 percent
FFP since the intent is for use in continuous operations.  (See 45 CFR 95 for standards for
depreciation and use allowances.) 
Costs for site preparation are operational start-up costs and matched at the 75 percent FFP 
rate. 
11276.5	 Costs Reimbursable at 75 percent FFP for MAR and SUR Activities and
Decision Support Systems 
Costs directly associated with personnel involved in MAR and SUR activities and the
cost for operation of Decision Support Systems (DSS) generally qualify for 75 percent
FFP. 
A.  MAR and SUR Activities 
In order for cost of  personnel directly associated in the production of reports for MAR
and SUR activities to qualify for 75 percent FFP the personnel must routinely perform
these functions (and/or SUR parameter changes) as part of their assigned responsibilities.
Costs associated with the use or follow-up action of these reports are not eligible for
enhanced FFP. 
B.  Decision Support Systems 
MMIS was designed to meet operational needs through the processing and payment of
claims and generation of pre-formatted management reports through the MAR and SUR
functionalities.  However, due to the information challenges in today's market, more
flexible and timely means of obtaining and reporting information is necessary. A DSS is
often a feasible means of managing data needs.  DSS is a universal term describing a
menu of hardware and software components which can be combined to facilitate access
to data and data analysis to serve a wide range of end-users.  A DSS provides a
mechanism to process data in a manageable quantity and format which is easily accessed
by users to manipulate data on-line.  A DSS can enhance the MAR and SUR 
functionalities by giving States the ability to access large volumes of data to produce
customized reports. 
The funding levels applicable to acquisition, implementation, and operation of a DSS are
listed below. These guidelines are predicated on the premise that the DSS is being
procured by a State as a replacement for or a supplement to the current MAR and SUR
reporting functionalities of the MMIS. A DSS procured for use with other than an MMIS
would not be eligible for enhanced funding match, and depending on its relationship (or
lack thereof) to the title XIX program, may (or may not) be eligible for only 50% match
(or no match). 
o  License fee for use of the proprietary software  75% FFP 
o	 Development of software to facilitate conversion
of data format, including use of PCS, mainframe or 
mass storage  90% FFP 
o  Initial conversion* of data, including use of PCS, mainframe,
or mass storage (for testing)  90% FFP 
Version 1  Page 3  04/04/2002  o  Repetitive cyclic conversion* of data  75% FFP 
*If the design of the operation of the DSS requires

a repetitive cyclic conversion of MMIS data then such

subsequent conversion costs will be funded at a 75% FFP rate.

o  Training of users  50% FFP 
o	 Operation of the DSS software, including use of PCS,
mainframe, or mass storage  75% FFP 
o  ADP professionals**  75% FFP 
o  Users**  50%  FFP 
**When a State employs an ADP professional to create/key-in the necessary parameters
which cause the DSS to generate user-requested reports, that ADP professional is
matchable at 75% FFP. However, USERS who have been trained to enter/key-in the
parameters necessary to generate their own reports from the DSS are only eligible for
50% FFP match. 
11276.6	 Costs Reimbursable at 75 Percent FFP for MMIS-Related Clerical or Manual 
Processing Activities. 
Although it is an objective of the MMIS to reduce manual processing (see 11276.3),
some manual intervention is necessary to make any computer system perform properly.
However, only those manual functions which are directly attributable to the operation of
the MMIS are funded at the enhanced FFP. 
11276.7	 Costs Reimbursable at 75 Percent FFP for Program Management, Prior
Authorization of Services, and Audit Functions. 
The 75 percent FFP for MMIS operations is available for claims processing and
information retrieval functions performed by the State agency or the fiscal agent.  This 
includes the actual processing of claims as well as the production of MMIS reports.  As 
such, the following functions must be reviewed in terms of their relationship to claims
processing and information retrieval. 
A.  Program Management. 
Although required to operate a Medicaid program, this function is not reimbursable at the
MMIS FFP rate unless directly related to claims processing or information retrieval.  For 
example, making a program management decision on a specific suspended claim is
allowable at 75 percent FFP.  However, the development and issuance of overall policy is
excluded.  The development of an edit for the claims processing system to implement a
program policy (e.g., a limitation of a service) is allowable at the 75 percent rate and
includes the cost of designing and implementing the edit.  The cost of the program
management staff that developed the policy is allowable only at the regular 50 percent
rate as part of ongoing program management. 
B.  Prior Authorization of Services. 
Version 1  Page 4  04/04/2002  A program management decision on a claim entered into the system and suspended is
allowable.  However, prior authorization of a service such as orthodontics or elective
surgery before the service is delivered is not allowable.  Such a decision is based on 
limitations in the State plan and not directly related to the mechanized claims processing 
system. 
C.  Audit. 
All State and fiscal agent audit activity is not eligible for enhanced FFP as an MMIS
activity.  This includes cost report audits, provider audits, and follow up investigation of
claims where fraud is suspected. 
11276.8  Postage Costs. 
The postage necessary to mail various products stemming from the operation of an
MMIS, e.g., checks, remittance advices, is not considered part of the operation of an
MMIS as defined in 11110.  Consequently, all postage costs associated with the 
operation of an MMIS are matched at the 50 percent FFP rate. 
11276.9  Reimbursement of Allocated Costs. 
Only direct costs allocable to the development or operation of an MMIS are eligible for
reimbursement at enhanced FFP rates.  Such costs include utilities, rent, telephone
service, etc., necessitated by either the development or operation of an MMIS. 
Costs which cannot be specifically identified with the development or operation of an
MMIS are matched at the 50 percent FFP rate.  Such costs are usually indirect costs
including the staff costs associated with agency-wide functions such as accounting,
budgeting, legal affairs, general administration, etc. 
This differentiation in the funding rates for these two types of costs is not applicable to
the reimbursement of fiscal agent costs. 
11276.10 Costs Reimbursable at 75 Percent FFP for Fiscal Agent MMIS Operations. 
A fiscal agent may perform many additional functions (see 11276.7) for the State
beyond those related to MMIS operations eligible for 75 percent FFP, yet bill the State at
one all inclusive rate per claim processed.  If this is the case, develop a cost allocation
plan through which payments to the fiscal agent are broken out for matching at the
appropriate FFP rates. (See 11276.9.) 
11276.11 List of Reimbursable Costs for State Systems.-
A.  Introduction. 
This section identifies those activities associated with the design, development,
installation, enhancement, and operation of an MMIS, and the appropriate FFP matching
rate for which each qualifies.  These costs must be specifically identified in the APD,
RFP and contract if they are to be claimed at the 90 percent rate.  Only items listed for 90
percent or 75 percent rate of funding qualify for enhanced FFP as expenditures for MMIS
under 1903(a)(3)of the Act. 
B.  List of Reimbursable Costs.-
Version 1  Page 5  04/04/2002  1.	 Design, Development, Installation,
or Enhancement of an MMIS 
Rate of  Text 
Item  ________________________  Funding  Reference 
Feasibility Study  50%  11275 
Planning activities (e.g., preparation
of an APD)  90%  11275 
Preparation of an RFP for an initial 90%  11275 
or replacement MMIS 11269 
Preparation of an RFP for an enhancement 90%  11275 
to an MMIS 
Proposal evaluation and contractor selection  90%  11275 
System and requirements analyses  90%  11110 
System design, development, installation,  90%  11275 
and enhancement 11110 
DIS  90%  11237 
11275 
Equipment costs only for use of such equip- 90%  11276.4 
ment in the design, development,
installation, or enhancement of an MMIS 
Direct personnel costs  90%  11276.2 
Direct non-personnel costs  90%  11276.9 
Indirect personnel and non-personnel costs  50%  11276.9 
Acceptance testing  90%  11237 
Supplies used during MMIS implementation  90%  11276.4 
Design, development, installation, or  0%  45 CFR 95.617(c)
enhancement of a proprietary system 
Site preparation  75%  11276.4 
Training of personnel engaged  50%  42 CFR 432.50(b)
in the design, development, or
installation of an MMIS 
2. MMIS Operational Costs 
Preparation of an APD and/or  75%  11275 
MMIS Operational Costs (continued) 
Version 1  Page 6  04/04/2002  Rate of  Text 
Item  ________________________  Funding  Reference 
RFP directed toward the potential change
of operator for  an approved MMIS 
Proposal evaluation and contractor selection  75%  11275 
Hardware used for MMIS operations  75%  11276.3 
Supplies used in the operation of an MMIS  75%  11276.4 
Claim forms (including encounter data)  75%  11276.3 
Entry and maintenance of provider  75%  11276.1 
enrollment data 
Direct costs of personnel directly associated  75%  11276.3 
with the operation of an approved MMIS
including staff responsible for: 
Data entry

Operations control

Exception and suspense processing  (continued)

Claims microfilming  (continued from  75%  11276.3

previous page):

Peripheral equipment operations

Computer operations

Claims coding

System documentation maintenance

Software maintenance

SURS parameter coding

System management

Entry and maintenance of data required under  75%  11100

HIPAA for purpose of electronic data interchange

Direct non-personnel costs  75%  11276.9

Indirect personnel and non-personnel  50%  11276.9

costs

Publications necessary for the  75%  11276.3

operation of an MMIS, such as,

required claim forms

Maintenance of the system necessary to  75%  11276.1

support claims processing and  11276.3

information retrieval functions of an MMIS

Postage  50%  11276.8

Provider relations directly related  75%  11276.1

to MMIS claims processing, such as,

entry and update of provider data

MMIS Operational Costs (continued) 
Version 1  Page 7  04/04/2002   Rate of  Text 
Item  ________________________  Funding  Reference 
MMIS production of: 75%  11276.3 
Checks or warrants, Remittance advices 
EOBs, Medical assistance ID cards,
MARS and SURS reports 
Operational costs of an initial or  50%  11255 
replacement MMIS until the system
has been approved 
Training of personnel directly engaged 75% 42CFR432.50(b)(2) 
in the operation of an MMIS 
3.  Other System Costs 
Local ADP systems (not statewide
 50%  11225 
in scope)

Automated administrative support 
 50%  11276.1 
systems (e.g., personnel,

financial management, office

automation)

Design, development, installation,
 50%  11280 
enhancement, and operation of

eligibility determination systems

Audit functions
 50%  11276.7 
Provider Manuals
 50%  11276.9 
Version 1  Page 8  04/04/2002  Attachment C

MMOODDEELL HHIIPPAAAA PPLLAANNNNIINNGG AAPPDD 
Health Insurance Portability and Accountability Act (HIPAA) 
The Planning APD is a very brief document (6-10 pages) prepared and submitted prior to initiating Planning Phase activities. It is used to secure Federal 
financial participation (FFP) for the State. It is a plan to plan. The purpose is not to provide needs and plans in detail but to develop a high-level 
management statement of vision, needs, objectives, plans, and estimated costs. The focus is on describing how planning will be accomplished and 
demonstrating that the State has established a plan that is reasonable for the level of effort of the project. Planning APDs that meet the standards for 
approval shown in the following two pages will be approved within 60 days. The Planning APD has four sections: 1. Statement of Need 2. Project 
Management Plan for planning 3. Planning project budget, and 4. Assurances . 
Section  Content  Description of Minimum Requirements 
Statement of  Reengineer Medicaid Management Information Systems to 
  Statement of  Vision  become compliant with the Administrative Simplification 
Need 
provisions of the Health Insurance Portability and Accountability 
Act.  (Please add more details if necessary) 
This section of the Planning 
APD should set forth the 
State's information and 
services "vision,"1 including 
the scope and objectives of 
the planned information 
  New or changed program  See Final Rule for Transactions and Code Sets published August 
system and its 
interrelationships with other  requirements  16, 2000.  Explain any differences. 
systems (if known). In 
addition, the needs statement 
should define the system 
  Problems or deficiencies in  The current MMIS is unable to process the new or changed 
requirements in terms of 
problems and needs listed in  existing system  requirements listed above. 
the next column. 
Project    Planning project 
organization (State and  Provide descriptive one page chart and one page of 
Management Plan 
contractor)  people,  accompanying narrative. 
responsibilities and 
The Project Management 
relationships 
Plan summarizes how the 
State will plan. 
  Planning activities,  Briefly summarize in one page or less. 
The State's planning project  products and deliverables 
organization is briefly 
described. At this point in the 
project, all that is required is  Requirements analysis    Yes    No 
that the State identify key  (e.g. Gap Analysis) 
players in the planning    Commitment to conduct :  Alternatives analysis    Yes    No 
phase, such as the project 
manager and other key  (Please provide a  Cost/benefit analysis    Yes    No 
planning staff by name and  statement when No is  JAD (joint application design 
title. This information can be  checked)  sessions with users)    Yes    No 
depicted in an organization 
Functional specification    Yes    No 
chart.  The Project 
Management Plan for  Systems design    Yes    No 
planning describes how and  Impact Assessment    Yes    No 
when the activities for the 
System interrelationships    Yes    No 
Planning Phase will be 
conducted and schedules  (if applicable) 
milestones for completion of 
key events. 
  State/contractor needs  Briefly summarize in one page or less. 
  Planning project 
procurement activities and  Briefly summarize in one page or less. 
schedule 
1 "Vision" means the State planners' view of future program needs and the systems architecture necessary to support those needs.  Attachment C

Section  Content  Description of Minimum Requirements 
Planning Project  By categories, cost elements  Anticipated State costs 
and amounts 
Budget 
Projected costs by fiscal quarter + summarized by fiscal year, 
including planning project total, and program totals. 
This section succinctly 
describes in narrative form 
Proposed time schedule 
the resource needs for which 
funding support during the 
Planning Phase may be 
requested by the State. 
These needs may relate to 
State and contractor staff 
costs, computer time, 
hardware and commercially 
available software, travel, 
space, supplies, telephones, 
photocopying, and so forth. 
This section of the APD also 
provides the budget and the 
cost allocation to be used 
during the Planning Phase. 
Assurances    Procurement Standards  45 CFR Part 95.613    Yes    No 
(Competition/Sole Source)  45 CFR Part 74    Yes    No 
This section refers to the  SMM Section 11267    Yes    No 
procurement of automated  SMD Letter of Dec. 4, 1995    Yes    No 
data processing equipment 
for mechanical claims 
processing, and whether it 
was procured under the  45 CFR Part 95.615    Yes    No 
appropriate requirements    Access to Records  SMM Section 11267    Yes    No 
outlined in the Code of 
Federal Regulations (CFR) 
listed, the appropriate 
sections of the State 
Medicaid Manual (SMM), and 
a State Medicaid Letter 
  Software Ownership 
(dated December 4, 1995). 
  Federal Licenses 
This section also refers to  42 CFR Part 433.112(b)(5)  (9)   Yes    No 
access to records, licensing,    Information Safeguarding 
ownership of software and 
the safeguarding of 
information contained within 
the system. 
  Progress Reports 
SMM Section 11267    Yes    No 
Explain all No answers and provide complete justification 
In addition to the four sections of the Planning APD, there is an additional provision at 45CFR  
95.605(vi), which requires a commitment to define the state's functional requirements for the 
purpose of evaluating the transfer of an existing system, including the transfer of another state's 
General Systems Design (GSD), which the state may adapt to meet state specific requirements. 
Model HIPAA Planning APD  2  Attachment D

MMOODDEELL HHIIPPAAAA IIMMPPLLEEMMEENNTTAATTIIOONN AAPPDD 
Health Insurance Portability and Accountability Act (HIPAA) 
Implementation APDs are written plans of action that States use to request Federal financial participation (FFP), in the designing, developing and 
implementing the system. States are required to submit an implementation APD prior to incurring costs for system design and development, when the total 
project costs (including planning) are estimated to exceed the thresholds in 45 CFR 95.611(b). The detail in the Implementation APD should be 
commensurate with the complexity and scope of the acquisition. This template provides an overview of the requirements of an Implementation APD and the 
need to keep the detail simple and focused on the issues below.  Implementation APDs that meet the standards for approval shown below will be approved 
within 60 days. 
*Not required if State has submitted a HIPAA Planning APD 
Section  Content  Description of Minimum Requirements 
Statement of 
Clearly state the purpose and objectives, including your vision of 
Need and 
  Statement of Needs and  the project, to be accomplished and the necessity for the project. 
Objectives 
Objectives  Include a basic description of the modification or system you 
seek to implement. 
In this Section of the 
Implementation APD, the 
State should summarize the 
current environment and the 
new system needs,    Problems or deficiencies in  The current MMIS is unable to process the new or changed 
objectives, and anticipated 
existing system*  requirements listed above 
benefits. Needs may be 
expressed in terms of 
deficiencies in existing 
capabilities, new or changed 
program requirements, or 
opportunities for economies 
or efficiencies.    New or changed program  See Final Rule for Transactions and Code Sets published August 
requirements*  16, 2000.  Explain any differences. 
Requirements 
Analysis,    General Requirements 
analysis (accomplished to  Provide a general requirements analysis (describing the 
Feasibility Study, 
date)  functional and technical needs), not to exceed 5 pages in length. 
and Alternatives 
Analysis 
The regulation at 45 CFR 
95.605(2)(iii) requires that 
the Implementation APD shall 
  Alternatives analysis 
include a requirements 
(Must identify which 
analysis, a feasibility study,  If the state has performed these analyses and study in the 
and a statement of alternative  alternatives were selected 
Planning APD, CMS will accept the Executive Summaries of 
considerations including,  for evaluation of costs and 
these documents as meeting the Implementation APD 
where appropriate, a transfer  benefits and provide the 
of an existing system, and an  requirement. 
rationale for selection of 
explanation of why such a 
transfer is not feasible, if  the chosen alternative). 
another alternative is 
identified. 
Model HIPAA Implementation APD 
1
 Attachment D

Section  Content  Description of Minimum Requirements 
Cost/Benefit    By cost basis,  Cost/Benefit Profile    Yes    No 
Analysis  assumptions, calculations,  (show benefit detail) 
and measurement plan 
related to performance,  Systems life benefits    Yes    No 
The State must provide a 
summary of the results of the  cost and benefit goals.  Spreadsheet 
cost/benefit analysis. 
Program performance 
improvements, projected 
costs, and anticipated 
benefits the system is 
expected to deliver must be 
described succinctly. 
Project    Nature, Scope, Methods,  As succinctly as possible, provide the following information: 
Activities, Schedule and 
Management Plan 
Deliverables    Provide a high level workflow addressing project activities, 
The Project Management    Project Organization and  milestones and contractor deliverables; 
Plan summarizes the project  Personnel Resources    Identify the project manager and other key staff by name and 
activities, deliverables, and    State and Contractor  title; 
products; project 
Resource Needs    Identify the relationship of the project team to the project 
organization; State and 
Contractor resource needs;    System Life  steering committee (if applicable); 
and anticipated system life.    Identify interrelationships with user group and contractors; 
  Identify the resource needs for which funding support may be 
requested by the State; 
  Describe the anticipated system life for the required 
resources 
Proposed Project    By phase, category and    A summary of all Implementation costs; by State and Federal 
cost amounts  shares (Refer to SMM, Part 11, Sections 11276-11280) 
Budget 
This Section contains all 
costs for Implementation 
Phase activities. 
Assurances 
  Procurement Standards  45 CFR Part 95.613    Yes    No 
This section refers to the  (Competition/Sole Source)  45 CFR Part 74    Yes    No 
procurement of automated 
SMM Section 11267    Yes    No 
data processing equipment 
for mechanical claims  SMD Letter of Dec. 4, 1995    Yes    No 
processing, and whether it 
was procured under the 
aouptplirnoepdri ainte t hree qCuoirdeem oefn ts    Access to Records  45 CFR Part 95.615    Yes    No 
Federal Regulations (CFR)  SMM Section 11267    Yes    No 
listed, the appropriate 
sections of the State 
Medicaid Manual (SMM), and    Software Ownership 
a State Medicaid Letter 
  Federal Licenses 
(dated December 4, 1995).  42 CFR Part 433.112(b)(5)  (9)   Yes    No 
This section also refers to    Information Safeguarding 
access to records, licensing, 
ownership of software and  SMM Section 11267    Yes    No 
  Progress Reports 
the safeguarding of 
information contained within  Explain all No answers and provide complete justification 
the system 
Model HIPAA Implementation APD 
2
 Attachment D

System  Content  Description of Minimum Requirements 
Cost Allocation    Type of FFP    List  FFP rate (enhanced or regular) by cost category per 
year 
The prospective cost 
  By phase, category and    List phase of implementation, program share of cost, total 
allocation plan is described, 
including procedures to  cost amounts  amount, FFP rate and Federal/State shares 
identify, record, allocate, and 
report direct and indirect 
costs, partially and fully 
attributable to the system 
project 
Model HIPAA Implementation APD 
3
 Attachment E 
DEC-5-1995 
Dear State Medicaid Director: 
We are writing to inform you of our policy on sole source procurements and prior approval 
requirements for certain procurements in light of recent revisions to our Departmental regulations. 
On August 25, 1994 the Department of Health and Human Services (DHHS) published an interim 
final rule in the Federal Register which amended 45 CFR Part 74. The amendments to Part 74 
contained in this rule deleted appendixes G and H, which set forth the procurement standards 
found in previous versions of the Office of Management and Budget (OMB) Circulars A-102, 
"Uniform Administrative Requirements for Grants-In-Aid To State and Local Governments" and 
A-110, "Grants and Agreements with Institutions of Higher Education, Hospitals and Other 
Non-Profit Institutions" respectively. Also deleted were many subparts of Part 74, including 
subpart P, which contained a provision that set forth the types of procurements that were 
governed by OMB Circulars A-102 and A-110. 
The interim final rule incorporated into Part 74 revisions which OMB made in its Circular A-110, 
which governs procurements by nongovernmental grant recipients. The preamble to the rule 
states that, in the future, DHHS and OMB intend to propose either a separate new regulation for 
the entitlement programs or a complete revision of OMB Circular A-102, which contained the 
procurement standards for grants to State and local governments. The Department has reserved 
45 CFR Part 92, subpart E, for future placement of entitlement program regulations. In the 
meantime, Part 74, as amended, remains applicable to the entitlement programs, including the 
Medicaid program. 
The deletion of Appendix G removed regulatory provisions regarding procurement standards 
which limited the circumstances under which Federal grantor agencies could require States to 
secure prior approval of procurements and related procurement documents. Also eliminated was 
the specific provision which permitted sole source procurement only in four limited 
circumstances. The deletion of subpart P removed the exception to the Circular A-102 
procurement standards for transactions between governmental entities. In deleting these 
provisions, the interim final rule did not indicate any intent to eliminate existing agency 
regulations or policies pertaining to these matters. 
In addition, we have consulted with DHHS officials on whether our existing policies on prior 
approval requirements and noncompetitive procurements are affected by the removal of Appendix 
G and subpart P of Part 74. We were advised that existing policies of  HHS awarding agencies 
pertaining to pre-award approval and other requirements regarding procurements remain valid 
unless they are specifically rescinded or amended by the awarding agencies. When the final rule is 
published, DHHS will include language in the preamble which will explicitly state that existing 
policies of awarding agencies are not invalidated by the Part 74 revisions.  Page 2 -State Medicaid Director

While the revisions described above would also affect the rules governing managed care

contracts, the Office of Managed Care in the Health Care Financing Administration (HCFA) has

separately established policies and guidelines for procurements entered into under managed care

arrangements, as well as those entered into under section 1915(b) freedom of choice waivers.

Therefore, this letter does not affect the Federal policy regarding those procurements.

Outside of the ambit of the managed care arrangements discussed above, HCFA will maintain

limited Federal oversight of State procurements. Pre-award review and approval of a State's

proposed contracts and related procurement documents, such as requests for proposals and

invitations for bids, will be required when any of the following conditions apply:

1. A State's procurement procedures or operations fail to comply with the procurement 
standards in 45 CFR Part 74. 
2. The procurement is expected to exceed the small purchase threshold fixed at 41 
U.S.C. 403(11) (currently $100,000) and is expected to be awarded without 
competition or only one bid or offer is received in response to a solicitation. 
3. The procurement is expected to exceed the small purchase threshold and specifies a . 
"brand name" product. 
4. The proposed award is over the small purchase threshold, and is to be awarded to 
other than the apparent low bidder under a sealed bid procurement. 
5. A proposed contract modification changes the scope of a contract or increases the 
contract amount by more than the amount of the small purchase threshold. 
While the revisions to Part 74 eliminated the provision which limited sole source procurement to 
specific delineated situations, the new regulations, at 74.43, retain the general requirement that 
all procurement transactions shall be conducted in a manner to provide, to the maximum extent 
practical, open and free competition. Therefore, we will continue to limit the allowability of 
noncompetitive procurements. The circumstances under which a contract may be awarded by 
noncompetitive negotiation are limited to the following: 
1.  The item is available only from a single source; 
2. 	Public exigency or emergency when the urgency for the requirement will not permit a 
delay incident to competitive solicitation; or 
3.  The Federal grantor agency authorizes noncompetitive negotiation; or 
4.  After solicitation of a number of sources, competition is determined inadequate.  Page 3 ~ State Medicaid Director 
We will not require prior approval for transactions between governments or agencies or 
instrumentalities of governments as long as there is an interagency agreement that does not 
provide for reimbursement above cost. We will require approval where the State Medicaid 
agency proposes to contract with another government or agency or instrumentality of government 
when there is a negotiated payment level which allows for profit. 
Federal policies give States considerable latitude in procurement processes. HCFA's oversight 
through prior approval requirements or evaluations of State procurement processes is meant to 
promote the purposes of the Medicaid program in a cost effective manner. We hope that this 
letter clarifies HCFA's role in States' procurement transactions in light of the revisions to 
45 CFR Part 74. 
If you have any questions regarding this matter, please contact Ed Davies on (410) 786-3280. 
/S/

Sally K. Richardson

Director

Medicaid Bureau

cc:

Regional Administrator

Regions I-X

Associate Regional Administrator

for Medicaid

Regions I-X

Associate Administrator for

Operations and Resource Management

Ms. Lee Partridge

Director, Health Policy Unit

American Public Welfare Association

Suite 500

810 First Street, NE

Washington, DC 20002-4267