DEPARTMENT OF HEALTH AND HUMAN SERVICES 

OFFICE OF INSPECTOR GENERAL 

WASHINGTON, DC 20201 

APR 11 2014 

TO: Marilyn Tavenner 

Administrator 

Centers for Medicare & Medicaid Services 

Leon Rodriguez 


Director 


Office for Civil Rights 


FROM: Brian P. Ritchie 

Acting Deputy Inspector General 

for Evaluation and Inspections 

SUBJECT: 	 Memorandum Report: Offshore Outsourcing ofAdministrative Functions 

by State Medicaid Agencies, OEI-09-12-00530 

This memorandum report provides information about State Medicaid agencies' 

requirements for outsourcing administrative functions offshore. Outsourcing occurs 

when Medicaid agencies enter into agreements with contractors to perform administrative 

functions. Outsourcing can occur inside the United States (domestic outsourcing) or 

outside (offshore outsourcing). In 2011, an Office oflnspector General (OIG) review 

found that one Medicaid agency was unaware that a contractor had sent electronic copies 

of Medicaid claims offshore for processing. This Medicaid agency inquired whether OIG 

had information regarding how States regulate offshore outsourcing. In response, we 

initiated the current study, obtaining information from all 56 Medicaid agencies regarding 

their requirements and practices for outsourcing administrative functions offshore. This 

memorandum report summarizes the information we collected from those States. 

SUMMARY 

Only fifteen of fifty-six Medicaid agencies have some form of State-specific requirement 

that addresses the outsourcing of administrative functions offshore. The remaining 

41 Medicaid agencies reported no offshore outsourcing requirements and do not 

outsource administrative functions offshore. Among the 15 Medicaid agencies with 

requirements, 4 Medicaid agencies prohibit the outsourcing of administrative functions 

offshore and 11 Medicaid agencies allow it. The 11 Medicaid agencies that allow 

offshore outsourcing of administrative functions each maintained Business Associate 

Agreements (BAAs) with contractors, which is a requirement under the Health Insurance 

Portability and Accountability Act (HIPAA). Among other purposes, BAAs are intended 

to safeguard protected health information (PHI). These 11 Medicaid agencies do not 

have additional State requirements that specifically address safeguarding PHI. 
 

 

 

 

Page 2 – Marilyn Tavenner and Leon Rodriguez 

Seven of the eleven Medicaid agencies that allow offshore outsourcing of administrative 

functions reported that they outsource offshore through subcontractors, but none reported 

sending PHI offshore. If Medicaid agencies engage in offshore outsourcing of 

administrative functions that involve PHI, it could present potential vulnerabilities. For 

example, Medicaid agencies or domestic contractors that send PHI offshore may have 

limited means of enforcing provisions of BAAs that are intended to safeguard PHI. 

Although some countries may have privacy protections greater than those in the United 

States, other countries may have limited or no privacy protections. 

BACKGROUND 

The Medicaid Program 

Medicaid is a joint Federal and State program that provides health care coverage to 

low-income and medically needy populations, such as children, senior citizens, and 

people with disabilities. States administer the Medicaid program subject to Federal 

guidelines and policies established by the Centers for Medicare & Medicaid Services 

(CMS).1

 For example, States establish—within Federal parameters—their own eligibility 

requirements, health care benefit packages for beneficiaries, and provider reimbursement 

rates. Medicaid agencies must cover acute and long-term care services that include, but 

are not limited to, inpatient and outpatient hospital services; laboratory and x-ray 

services; and nursing home facilities and home health care.2 In addition, Medicaid 

agencies may choose to cover optional services such as prescription drugs, durable 

medical equipment, and personal care services.3 

Medicaid Agencies’ Administrative Functions 

Medicaid agencies perform a variety of functions, usually through the integration of 

information technology (IT) or data systems, to support the administration of the 

Medicaid program. Medicaid administrative functions include, but are not limited to:4 

 enrolling eligible individuals, 

 determining what benefits the Medicaid agency will cover, 

 determining how much the Medicaid agency will pay for covered benefits and 

from whom it will purchase services (i.e., fee-for-service and managed care 

plans), 

 having a system for processing claims from fee-for-service providers and making 

capitation payments to managed care plans, 

 monitoring the quality of the services that the Medicaid agency purchases, 

 ensuring that State and Federal health care funds are not spent improperly or 

fraudulently, 

 collecting program information and reporting it to CMS, and 

 resolving grievances from applicants, beneficiaries, providers, and health plans. 

1

 Social Security Act (SSA) §§ 1901–1936, 42 U.S.C. §§ 1396–1396v. 

2

 42 CFR § 440.210.
 3

 42 CFR § 440.220.
 4

 See generally SSA § 1902(a), 42 U.S.C. § 1396a(a). 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

 

 

 

Page 3 – Marilyn Tavenner and Leon Rodriguez 

Outsourcing of Medicaid Administrative Functions 

Although Federal law requires that each State designate a single State agency to 

administer the State’s Medicaid program, Medicaid agencies have the authority to 

delegate or outsource their administrative functions to other State agencies and/or 

contractors.5, 6 Medicaid agencies may outsource by entering into agreements with 

contractors to perform specific administrative functions on a periodic or routine basis. 

These contractors may be private companies identified as covered entities,7

 business 

associates,8, 9 or trading partners.10 

Medicaid agencies may outsource directly, i.e., through contractors, or indirectly, 

i.e., through subcontractors. Direct offshore outsourcing occurs when a Medicaid agency 

contracts with an offshore contractor. Indirect offshore outsourcing occurs when a 

Medicaid agency’s contractor subcontracts to an offshore contractor. In a 2006 report on 

45 State Medicaid agencies, the Government Accountability Office (GAO) found that at 

least one Medicaid agency directly outsourced offshore and at least one Medicaid agency 

indirectly outsourced offshore. GAO stated that such reporting may be understated 

because many Federal contractors and agencies did not know whether their domestic 

vendors transferred personal health information to other locations or vendors.11 

Moreover, the GAO report did not assess States’ compliance with existing HIPAA 

regulations. 

5 SSA § 1902(a)(5), 42 U.S.C. § 1396a(a)(5). 

6

 42 CFR § 431.10. 

7

 Covered entities are health plans, clearinghouses, and providers that electronically transmit PHI. 

Examples of PHI include a beneficiary’s name, Medicaid number, billing transactions, and date of birth. 

PHI can be transmitted in electronic, oral, or paper formats. The HIPAA Privacy Rule provides Federal 

safeguards to maintain the privacy of PHI. Health plans, including Medicare and Medicaid, provide or pay 

for the cost of health care. Clearinghouses process and convert health information from one format to 

another. Health care providers include physicians and pharmacies that electronically submit PHI for 

financial or administrative transactions, such as beneficiary claims. 45 CFR § 150.103. 8

 Business associates are persons or organizations that perform certain functions involving the use or 

disclosure of PHI on behalf of a covered entity. Business associates are subject to the HIPAA Privacy 

Rule. 45 CFR § 150.103. 

9 Covered entities and business associates must have BAAs. Covered entities are required to have BAAs 

for “downstream” outsourcing—i.e., when the original outsourcing contract is followed by one or more 

subcontracting arrangements. In such cases, BAAs must establish the conditions under which downstream 

contractors may use and disclose PHI and must include the required privacy safeguards. 45 CFR 

§§ 150.103 and 165.504(e).

10 Trading partners are entities that transmit electronic health data to covered entities, business associates, 

providers/suppliers, and software vendors, or that receive such data. Trading partners are subject to the 

HIPAA Privacy Rule. 

11 GAO, Domestic and Offshore Outsourcing of Personal Information in Medicare, Medicaid, and 

TRICARE, GAO-06-676, September 2006. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

 

Page 4 – Marilyn Tavenner and Leon Rodriguez 

Federal Requirements for Offshore Outsourcing 

There are no Federal regulations that prohibit the offshore outsourcing of Medicaid 

administrative functions. CMS requires that Medicare contractors or subcontractors 

obtain written approval prior to performing system functions12 offshore.13 Although there 

are no similar requirements from CMS for Medicaid, CMS has issued guidance in 

accordance with the Affordable Care Act (ACA) stating that Medicaid agencies are 

permitted to provide payments to contractors operating offshore for tasks—including 

administrative functions—that support the administration of the Medicaid program.14, 15 

METHODOLOGY 

We conducted an electronic survey of all 56 Medicaid agencies.16 In May 2013, we 

asked these agencies (1) whether they had any policies, Executive Orders, State laws, or 

contract requirements (collectively, “requirements”) that addressed the outsourcing of 

administrative functions offshore17 and (2) whether they directly or indirectly outsourced 

administrative functions offshore. 

For Medicaid agencies with outsourcing requirements, we asked whether the 

requirements included provisions specifically addressing PHI and whether the Medicaid 

agencies monitor contractors’ compliance with the outsourcing requirements. We 

requested their requirements and BAAs, and we reviewed the requirements to identify the 

type or form of the requirement. For the Medicaid agencies that outsource administrative 

functions offshore, we asked what types of administrative functions are outsourced 

offshore. In June 2013, we conducted telephone interviews, as needed, with selected 

Medicaid agencies to clarify survey responses, and in some cases, we clarified 

inconsistent survey responses via email. 

This study was conducted in accordance with the Quality Standards for Inspection and 

Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency. 

12 Medicare system functions include, but are not limited to, the transmission of electronic claims, receipt 

of remittance advice, or any system access to obtain beneficiary PHI and/or eligibility information. 13 Medicare Fee For Service Standard Companion Guide, page 18. Accessed at 

http://www.medicarenhic.com/edi/download/J14%20PART%20B%20Medicare%20FFS%205010A1%20C 

ompanion%20Guide.pdf on May 25, 2012. Appendix A, CMSR High Impact Level Data, Section SA-9. 

Accessed at http://www.cms.gov/informationsecurity/downloads/ARS_App_A-CMSR_HIGH.pdf on 

May 25, 2012. 

14 ACA, P.L. No. 111-148, § 6505. 

15 Although Medicaid agencies cannot pay for health care benefits or services to any entity located offshore 

or provided by offshore providers, payments for administrative functions are permitted. CMS, State 

Medicaid Directors Letter #10-026, December 2010. 16 Medicaid agencies include those in the District of Columbia, the Commonwealth of Puerto Rico, the 

United States Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana 

Islands. 

17 We sent letters to each State Medicaid Director requesting contact information for the person or persons 

knowledgeable about whether the agency outsources administrative functions offshore. We then sent the 

survey to those contacts. In some cases, State Medicaid Directors identified themselves as the appropriate 

contact. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

Page 5 – Marilyn Tavenner and Leon Rodriguez 

RESULTS 

Fifteen Medicaid agencies have requirements addressing the offshore outsourcing of 

administrative functions 

Only one-quarter (15 of 56) of Medicaid agencies reported having some form of 

requirement addressing the offshore outsourcing of Medicaid administrative functions. 

Of those 15 Medicaid agencies, 11 have requirements that allow such offshore 

outsourcing. Nine of the eleven Medicaid agencies have requirements that allow offshore 

outsourcing with very few restrictions, and 2 of the 11 have requirements that allow 

offshore outsourcing only under limited circumstances. The remaining 4 of the 

15 Medicaid agencies have requirements that prohibit the offshore outsourcing of 

administrative functions. None of the 41 States without such requirements reported 

outsourcing Medicaid administrative functions offshore. 

Nine Medicaid agencies have requirements allowing offshore outsourcing with very few 

limitations. Among the nine Medicaid agencies that allow offshore outsourcing with 

very few limitations, three agencies addressed offshore outsourcing through Executive 

Orders, State laws, or a Medicaid agency policy manual. The remaining six Medicaid 

agencies addressed offshore outsourcing through contract provisions. All nine Medicaid 

agencies allow indirect offshore outsourcing—i.e., they allow their direct contractors to 

have offshore subcontractors. Two of these Medicaid agencies also allow direct offshore 

outsourcing, in which the Medicaid agency contracts with offshore contractors for 

administrative functions. Two other Medicaid agencies allow indirect offshore 

outsourcing, but specifically prohibit direct offshore outsourcing. (Table 1 shows details 

on the nine agencies that allow offshore outsourcing with very few limitations.) 

According to the requirements that these nine Medicaid agencies have in place, the 

agencies must approve any contractor requests to outsource administrative functions 

offshore. Among the nine Medicaid agencies, views and practices regarding offshore 

outsourcing varied—some reported that they outsource offshore on a case-by-case basis, 

some reported giving preference to domestic contractors, and some reported that they 

generally do not view the offshore outsourcing of administrative functions any differently 

than they view domestic outsourcing. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

 

 

 

 

 

 

 

Page 6 – Marilyn Tavenner and Leon Rodriguez 

Table 1: Description of Nine Medicaid Agencies’ Requirements Allowing Offshore 

Outsourcing of Administrative Functions with Very Few Restrictions 

State Medicaid 

agency 

Form of 

requirement18 

Description of 

the requirement 

for direct

offshore 

outsourcing 

Description 

of the 

requirement 

for indirect

offshore 

outsourcing 

Does the 

requirement 

specifically 

address 

PHI? 

Does the 

State monitor 

contractor 

compliance 

with the 

requirement? 

Florida State law19 No requirement Allows No Yes 

Massachusetts 

Contract 

provisions No requirement Allows No Yes 

Mississippi 

Contract 

provisions No requirement Allows No Yes 

Montana 

Contract 

provisions Prohibits Allows No Yes 

New Mexico 

Contract 

provisions Prohibits Allows No Yes 

North Dakota 

Contract 

provisions No requirement Allows No Yes 

Pennsylvania 

Executive 

Order20 Allows Allows No Yes 

Rhode Island 

Contract 

provisions No requirement Allows No Yes 

Tennessee 

Medicaid Policy 

Manual Allows Allows No Yes 

The nine Medicaid agencies did not have offshore outsourcing requirements that 

specifically addressed the safeguarding of PHI. Instead, these nine Medicaid agencies 

require contractors and subcontractors to have BAAs complying with HIPAA 

requirements for the protection of PHI. HIPAA requires that BAAs specify the 

contractor’s responsibilities for safeguarding PHI, the circumstances under which PHI 

18 In their contract provisions, Medicaid agencies may reiterate and/or expand on the requirements they 

have already specified elsewhere (e.g., in Executive Orders, State law, and Medicaid policy manuals).

19 The Medicaid agency allows indirect offshore outsourcing for managed care organizations and prepaid 

health plans; however, certain statutory and/or contractual restrictions exist. For example, contract 

provisions may require that some administrative functions be performed in a domestic location.

20 Contractors must identify during the procurement process whether they or any subcontractor will perform 

administrative functions offshore. During the selection of contractors, the State may give additional 

consideration to contractors that will perform services within the United States. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
Page 7 – Marilyn Tavenner and Leon Rodriguez 

may be used and disclosed, and the requirements for reporting PHI violations or 

breaches. However, for all nine agencies, BAAs did not specifically address the offshore 

outsourcing of administrative functions involving PHI. If Medicaid agencies engage in 

offshore outsourcing of administrative functions that involve PHI, it could present 

potential vulnerabilities. For example, Medicaid agencies or domestic contractors who 

send PHI offshore may have limited means of enforcing provisions of BAAs that are 

intended to safeguard PHI. Although some countries may have privacy protections 

greater than those in the United States, other countries may have limited or no privacy 

protections to support HIPAA compliance. 

All nine Medicaid agencies reported that they monitored contractors to ensure 

compliance with the agencies’ requirements on offshore outsourcing. Although some of 

these Medicaid agencies reported that they directly monitor subcontractors, other 

Medicaid agencies reported that they rely on contractors to monitor subcontractors. 

Examples of monitoring activities reported by the nine Medicaid agencies included 

approving contractors’ requests to subcontract; conducting ongoing reviews of 

contractors’ and/or subcontractors’ policies and procedures; and requiring performance 

reports from contractors. These activities may vary based on the scope of the contract. 

Two Medicaid agencies have requirements allowing offshore outsourcing only under 

limited circumstances. Two Medicaid agencies addressed offshore outsourcing through 

an Executive Order or a State law. As shown in Table 2, both of these Medicaid agencies 

allow offshore outsourcing directly and indirectly. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

 

Page 8 – Marilyn Tavenner and Leon Rodriguez 

Table 2: Description of Two Medicaid Agencies’ Requirements Allowing Offshore 

Outsourcing of Administrative Functions Only Under Limited Circumstances 

State 

Medicaid 

agency 

Form of 

requirement21 

Description 

of the 

requirement 

for direct

offshore 

outsourcing 

Description 

of the 

requirement 

for indirect

offshore 

outsourcing 

Examples of 

circumstances 

under which 

offshore 

outsourcing is 

allowed 

Does the 

requirement 

specifically 

address 

PHI? 

Does the 

State monitor 

contractor 

compliance 

with the 

requirement? 

Missouri 

Executive 

Order22 Allows Allows 

Contractor or 

subcontractor 

must meet one of 

four conditions, 

such as providing 

a unique service 

that is mandatory 

for the State to 

purchase 

No Yes 

New 

Jersey State law Allows Allows 

The function or 

service cannot be 

provided by 

domestic 

contractor or 

subcontractor 

No Yes 

Source: OIG analysis of State survey responses and regulations, 2013. 

One Medicaid agency reported that State agencies must award contracts to domestic 

contractors unless certain circumstances exist—for example, the contractor or 

subcontractor provides a unique service that is mandatory for the State agency to 

purchase. The second Medicaid agency reported that all contracts awarded by the State 

must be performed domestically except when the contracted services cannot be provided 

within the United States. In such cases, the contractor and subcontractor must specify 

why these services cannot be performed domestically. Both Medicaid agencies reported 

that they must approve offshore outsourcing contracts. For more information about the 

two Medicaid agencies’ regulations, see the Appendix. 

Similar to the nine Medicaid agencies that allow offshore outsourcing with very few 

limitations, these two Medicaid agencies do not have requirements that specifically 

address PHI. However, these two Medicaid agencies include requirements to protect PHI 

in BAAs with all contractors and subcontractors. In both States, the Medicaid agency 

contractors must also have BAAs with their respective subcontractors that include similar 

requirements for protecting PHI. 

Both Medicaid agencies reported monitoring contractors and subcontractors. For 

example, one of the Medicaid agencies reported that all contract requirements are 

monitored for compliance by the contract administrator and by the State agency 

responsible for oversight of State contracts. 

21 As noted in Footnote 18, Medicaid agencies may use contract provisions to reiterate and/or expand on
 

requirements they have already specified elsewhere. 22 Contractors must disclose the location where all services are performed. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
Page 9 – Marilyn Tavenner and Leon Rodriguez 

Four Medicaid agencies have requirements prohibiting offshore outsourcing. Of the four 

Medicaid agencies with requirements prohibiting the offshore outsourcing of 

administrative functions, three rely on Executive Orders that prohibit such outsourcing 

and one relies on contract provisions that prohibit it. All four Medicaid agencies reported 

monitoring contractors and subcontractors to ensure compliance with the agencies’ 

regulations. For example, contractors and subcontractors sign attestations of compliance 

with the Medicaid policies, disclose the location where all work is performed, and/or 

provide the primary place of business for the contractor or any subcontractor. 

Seven Medicaid agencies reported currently outsourcing Medicaid administrative 

functions offshore 

Seven of the fifty-six Medicaid agencies reported that they currently outsource 

administrative functions offshore; all seven of these have requirements allowing offshore 

outsourcing. As shown in Table 3, all seven Medicaid agencies indirectly outsource 

offshore, and one of the seven also directly outsources offshore. 

Table 3: Description of the Seven Medicaid Agencies’ Practices for Outsourcing 

Administrative Functions Offshore 

State Medicaid 

agency 

Form of requirement 

Examples of 

administrative functions 

outsourced offshore 

Type(s) of offshore 

outsourcing 

Florida State law IT Indirect 

Massachusetts Contract provisions IT Indirect 

Mississippi Contract provisions 

No specific types or 

examples Indirect 

Missouri Executive Order 

No specific types or 

examples Direct and indirect 

Montana Contract provisions 

No specific types or 

examples Indirect 

North Dakota Contract provisions IT Indirect 

Rhode Island Contract provisions IT Indirect 

Source: OIG analysis of State survey responses and regulations, 2013. 

Four of the seven Medicaid agencies reported that the most common type of 

administrative function that is outsourced offshore relates to IT. For example, a 

Medicaid contractor in one State reported that it outsourced the Medicaid Management 

Information System (MMIS) implementation projects to offshore programmers and 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
 

Page 10 – Marilyn Tavenner and Leon Rodriguez 

software developers.23 In another State, a domestic contractor used offshore 

subcontractors to help develop and design a new claims processing system for the 

Medicaid agency. In this instance, the offshore subcontractor designed programming and 

systems testing for this new system. The remaining three Medicaid agencies did not 

report any common type of administrative functions that are outsourced offshore. 

All seven Medicaid agencies reported that they do not outsource offshore any 

administrative functions involving PHI. In fact, some of these seven Medicaid agencies 

reported that for administrative functions involving PHI, they strongly prefer to outsource 

only domestically. For example, one of the seven Medicaid agencies explicitly reported 

denying all requests to send offshore any administrative functions involving PHI. 

CONCLUSION 

This memorandum report provides information about the current Medicaid environment 

for outsourcing administrative functions offshore. As of June 2013, 15 of 56 Medicaid 

agencies had some form of State-specific requirments that addressed offshore 

outsourcing. The remaining 41 Medicaid agencies reported no offshore outsourcing 

requirements and do not outsource administrative functions offshore. Among the 

15 Medicaid agencies with requirements, 4 Medicaid agencies prohibit the outsourcing of 

administrative functions offshore and 11 Medicaid agencies allow it. The 11 Medicaid 

agencies that allow offshore outsourcing of administrative functions each maintain BAAs 

with contractors, which is a requirement under HIPAA. Among other things, BAAs are 

intended to safeguard PHI. These 11 Medicaid agencies do not have additional State 

requirements that specifically address the safeguarding of PHI. Seven of the eleven 

Medicaid agencies reported outsourcing offshore through subcontractors, but none 

reported sending PHI offshore. If Medicaid agencies engage in offshore outsourcing of 

administrative functions that involve PHI, it could present potential vulnerabilities. For 

example, Medicaid agencies or domestic contractors who send PHI offshore may have 

limited means of enforcing provisions of BAAs that are intended to safeguard PHI. 

Although some countries may have privacy protections greater than those in the United 

States, other countries may have limited or no privacy protections. 

This report is being issued directly in final form because it contains no recommendations. 

If you have comments or questions about this report, please provide them within 60 days. 

Please refer to report number OEI-09-12-00530 in all correspondence. 

23 MMIS is a claims processing and information retrieval system for Medicaid. All Medicaid agencies 

operate an MMIS to support program administration and maintain information, such as provider enrollment 

and claims processing. Medicaid agencies may use a contractor to operate their MMIS. 42 CFR pt. 433. 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
Page 11 – Marilyn Tavenner and Leon Rodriguez 

APPENDIX: STATE REQUIREMENTS FOR TWO MEDICAID AGENCIES 

THAT ALLOW OFFSHORE OUTSOURCING OF ADMINISTRATIVE 

FUNCTIONS UNDER LIMITED CIRCUMSTANCES 

State of Missouri’s Executive Order 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
Page 12 – Marilyn Tavenner and Leon Rodriguez 

APPENDIX (continued) 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530) 
Page 13 – Marilyn Tavenner and Leon Rodriguez 

APPENDIX (continued) 

State of New Jersey’s State Law 

Offshore Outsourcing of Medicaid Administrative Functions (OEI-09-12-00530)