Under federal law, states are eligible for an enhanced federal matching rate of 90 percent for the design, development, or installation of Medicaid claims processing and information retrieval systems. Historically, CMS had allowed states to claim this 90 percent matching rate for the design, development, or installation of system changes to MMIS, which includes Medicaid claims processing, among other things, but such a match was not available for Medicaid eligibility IT systems changes. However, in 2011, CMS extended the availability of the 90 percent matching rate for which includes undertaking changes to Medicaid eligibility IT systems,efforts to implement the “no wrong door” policy. Under this policy, individuals can apply for health coverage through an exchange or a state’s Medicaid agency, and regardless of which “door” they choose, their eligibility will be determined for coverage under Medicaid, CHIP, or the exchange, including any income-based subsidies available through the exchange. To this end, applications are then to be routed to the program for which the individual is eligible. Along with the “no wrong door” policy, CMS envisioned streamlined enrollment processes that include the real-time transfer of applications between state Medicaid agencies and the FFE, and immediate eligibility determinations. States are eligible to use 90/10 funding for changes they make to their Medicaid IT systems regardless of whether they are operating their own exchanges or using the FFE. States may also receive a 75 percent matching rate for the maintenance and any ongoing costs of operating an upgraded Medicaid eligibility system. The 75 percent FFP is generally available when the Medicaid eligibility system changes become operational, and unlike 90/10 funding, does not expire. To access 90/10 funding, states must first submit advanced planning documents (APDs) to CMS—the federal agency that oversees the Medicaid program and provides guidance and technical assistance to states related to Medicaid eligibility system changes. CMS reviews the APDs to ensure that certain technical and operational criteria are met before states are eligible for 90/10 funding. To receive CMS approval, states must develop IT systems that meet technical standards and conditions, which require states to develop IT systems that are flexible, advance the Medicaid Information Technology Architecture principles, and promote data exchanges and the reuse of Medicaid technologies across systems and states, among other things. In addition to these technical requirements, CMS specified operational requirements—known as critical success factors—to help states prioritize the many changes that they were making to their eligibility systems to comply with PPACA. Due to differences among states in their approaches to establishing an exchange, not all states needed to implement all critical success factors. For example, states running their own exchanges would not need to implement the factor relating to sending and receiving applications to and from the FFE. That particular factor would only apply to the states that were using the FFE. (See table 1.) To claim the federal share of state costs for these eligibility system changes, states report their expenditures on the form CMS-64, which states complete quarterly to obtain federal reimbursement for services or administrative costs under the Medicaid program. State Medicaid agencies submit expenditure information 30 days after a quarter has ended, and CMS reviews these submissions to authorize and compute the applicable federal share of expenditures claimed. Even after reporting, states are permitted to adjust previously reported expenditures on the CMS-64 for up to 2 years from the quarter of their initial reporting. Any adjustments that a state makes will appear in the quarter in which the state made it, but will not be applied retroactively to the state’s initial report. Reported spending of 90/10 funding across all 50 states and the District of Columbia totaled more than $1.8 billion for Medicaid eligibility IT system changes as of September 30, 2014, with the federal government contributing more than $1.6 billion and states contributing about $200 million. Over three quarters of states’ reported spending of 90/10 funding—$1.4 billion—was for contractors selected by states to implement changes to their eligibility IT systems. Although 90/10 funding was available to states beginning in April 2011, only 2 states reported spending funds on Medicaid eligibility IT system changes by September 30, 2011. Over the next year, however, the number of states reporting such spending increased dramatically; and by March 2014, all 50 states and the District of Columbia had reported related spending. Similarly, the amount of spending reported for each quarter has also grown steadily, with the most significant increases reported over the most recent quarters. (See fig. 1.) Appendix I includes information on 90/10 funding by state. Across the country, states’ changes to Medicaid eligibility IT systems ranged from full system replacements to more limited modifications, with the scope of a state’s changes dependent on a number of factors, including the age of their system and the extent of integration among state programs. According to CMS, 34 states implemented full system replacements, while 17 states implemented system modifications. State- reported spending of 90/10 funding varied widely, ranging from $1.8 million in South Dakota to $180 million in North Carolina, as of June 30, 2014. (See fig. 2.) Although there were spending differences among individual states, the median amount spent on eligibility IT systems in states modifying their systems was about one half of the median amount spent in states that were undertaking full system replacements during this time. Among the six states we reviewed, the prior Medicaid eligibility IT systems in five of the states were 20 to 30 years old, and varied in terms of the extent of integration with other state programs and overall function, as illustrated by the following two examples. North Carolina’s prior Medicaid eligibility IT system was a state-based system that was over 30 years old, and was used to determine eligibility and process enrollment for 17 programs run by the state’s Department of Health and Human Services, according to state officials. The state had begun development of a new integrated IT system in 2009, and was continuing to work on its implementation when 90/10 funding became available. Hawaii’s Medicaid eligibility IT system was a state-wide system that was over 25 years old, and was also used to determine eligibility for the Supplemental Nutrition Assistance Program, Temporary Assistance to Needy Families, and other human service programs, according to state officials. However, the state separately contracted with the Arizona Medicaid program to conduct program enrollment activities, and Hawaii officials noted that they expected this arrangement to continue for the foreseeable future. The state officials added that Hawaii had needed a new eligibility IT system for quite some time, but was not able to pursue IT improvements until 90/10 funding became available. Differences in state-reported spending could reflect other factors, such as a state’s readiness to implement a new eligibility IT system. For example, two states we reviewed—New Mexico and North Carolina—were able to obtain approval and claim expenditures for 90/10 funding soon after it became available, because they were already working on eligibility IT system improvements. As previously noted, states’ spending on the maintenance and operation of these new systems is eligible for a federal match of 75 percent. Through September 30, 2014, 27 states reported spending an additional $205 million on maintenance and operation activities, about 79 percent of which was paid to contractors.state spending for maintenance and operation costs. Selected states implemented most of the critical success factors using alternative approaches, which often reflected unique program aspects. However, all states using the FFE faced challenges transferring applications to and from the FFE, and those challenges contributed to enrollment delays. Officials from the selected states reported that they were largely able to implement three critical success factors that applied to all states—the abilities to (1) accept a single, streamlined application; (2) verify applicant eligibility based on electronic data sources, such as the federal data services hub; and (3) convert existing income standards to MAGI, and process Medicaid applications based on these rules—by the beginning of the initial open enrollment period, October 1, 2013. The six states we reviewed often used alternative approaches, which CMS approved, to implement each of these three critical success factors. (See table 2.) In some states, the use of these alternative approaches reflected unique program aspects of states’ Medicaid programs or IT systems, as illustrated by the following examples. To implement the factor related to accepting a single, streamlined application, four states we reviewed (Kansas, New Mexico, North Carolina, and Pennsylvania) developed alternative applications that were tailored to their specific programs.developed an alternative application to reflect the integration of its Medicaid eligibility and enrollment system with its Supplemental Food and Nutrition Program and its Temporary Assistance to Needy Families program, according to state officials. In particular, New Mexico For the critical success factor relating to verifying applicant income, three states we reviewed (Kansas, New Mexico, and North Carolina) used existing state sources to verify applicant eligibility instead of relying on the federal data services hub. In North Carolina, for example, officials indicated that the state received approval for an alternative to the hub, and chose to rely on its existing link to the Social Security Administration, as well as other sources for verification. For the critical success factor relating to MAGI criteria, five states we reviewed opted to convert their eligibility rule systems to MAGI, and one state—Kansas—opted instead to use CMS’s MAGI-in-the-Cloud to determine eligibility because its new eligibility system, the Kansas Eligibility Enforcement System, is not expected to be operational until November 2014, according to state officials. The remaining two critical success factors—the minimum essential coverage (MEC) check and the application transfer function—apply to the 36 states using the FFE and involve transmitting information between state and federal data sources, which we refer to as IT connections. For the MEC check, states’ Medicaid IT systems were to respond to electronic inquiries from the FFE on applicants’ current Medicaid or CHIP coverage, a one-way transmission of information from the FFE to the state. While none of the 36 states using the FFE was able to establish this connection by the first day of the initial open enrollment period, 22 states were able to do so at some point in October 2013, and were joined The experiences in by another 3 states by the end of December 2013.our selected states largely mirrored the experiences of states nationally. For the 4 states using the FFE that we reviewed, Pennsylvania implemented the MEC check by October 6, 2013, while North Carolina and New Mexico implemented this critical success factor on November 12, 2013, and January 16, 2014, respectively. Kansas had not implemented the MEC check as of October 2014. Officials in some of the states we reviewed cited the complexity of establishing the IT connection as contributing to initial delays in implementation. Because states typically had different dates in which they were able to implement each connection, we discuss states’ abilities to send applications to the FFE or receive applications from the FFE separately. Collectively, we refer to sending and receiving as “transferring applications” or “application transfers.” FFE, with 7 states doing so; an additional 23 states began to send applications to the FFE during the subsequent 5 months. States also gradually began receiving applications from the FFE, with the first states doing so in December 2013, and implementation in the remaining states generally occurring by the end of April 2014. However, nearly a year after the initial open enrollment period, a handful of states remain unable to transfer applications. (See fig. 3.) CMS officials noted that they continue to work with these states to ensure implementation as soon as possible. However, the capability to conduct real time application transfers for immediate eligibility determinations remains elusive in all states. While a CMS official acknowledged that real time application transfers continue to be a goal, he does not anticipate this occurring until 2015 or 2016, given variability in states’ abilities. Some of the states that we reviewed cited evolving technical requirements from CMS as a challenge to their initial efforts to implement this critical success factor. For example, CMS issued the initial technical requirements for application transfers in April 2013 and then final requirements two months later—about three months before the open enrollment period. Since CMS’s technical requirements involve thousands of lines of code, a CMS official acknowledged that changes to the initial requirements created additional work for states that were following them. A New Mexico official indicated that the state made some initial assumptions in developing its system that later needed modifying once CMS issued final requirements. A CMS official noted variation in states’ abilities to make such adjustments in a timely manner and that some states began incorporating the initial requirements into their systems, while other states purposely waited for the final requirements. The delay in FFE readiness to transfer applications to and from the states further complicated efforts to implement this critical success factor. A CMS official acknowledged that the FFE was not ready to send or receive applications when open enrollment began. CMS was first able to receive applications from states in mid-October 2013 and to send applications to states in November 2013. The official also indicated that some states’ systems were not ready to receive applications despite successful testing of their systems. In such cases, the agency worked with states to send applications to them incrementally until their systems were working properly and were able to receive greater numbers of applications. Because states were not able to transfer applications in time for open enrollment, CMS provided states with a subset of the information from the applications submitted to the FFE in a simple excel spreadsheet, which they called a “flat file,” beginning on October 16, 2013. While the flat file did not necessarily advance state efforts toward developing the IT connections needed to transfer applications, it did provide states with a sense of the volume of applications they would receive from the FFE, and allowed them to reach out to potentially eligible individuals to encourage them to apply directly to the state’s Medicaid office. Officials in some of the states we reviewed, including New Mexico and Pennsylvania, did not find the flat file useful in identifying and enrolling eligible individuals, citing the limited information provided. However, CMS issued guidance on November 29, 2013, that gave states the option to obtain a waiver allowing them to enroll applicants into Medicaid using information from the flat file. The states that we reviewed did not seek such a waiver; however, six other states using the FFE did seek waivers. For the estimated 2.9 million Medicaid applications waiting for processing in states cited in a June 2014 report, delayed implementation of the application transfer function—while not the sole factor behind delays—did have implications for enrollees’ timely enrollment in Medicaid. For example, Pennsylvania officials attributed some of its application backlog of 60,000 Medicaid applications in spring 2014 to delays in receiving applications from the FFE, but also noted other reasons, such as the state’s process for non-MAGI applications received from the FFE, which may have required additional contact or verification by the state. As another contributing factor to delayed enrollment, the initial open enrollment period saw a surge of Medicaid applicants seeking health insurance coverage, but the capacity of states to process this enrollment surge varied. Incomplete or inconsistent application data also affected states’ ability to process applications in a timely manner. The officials from the sample states we interviewed that established state-based exchanges and were not using the FFE to transfer applications cited backlogs due to technology challenges, as well as the volume of applications received. For example, Minnesota officials attributed the state’s backlog to initial technology issues with applications that were not correctly processed in the system and required manual processing. Similarly, Hawaii officials remarked that the backlog of applications at the beginning of the initial open enrollment period was due, in part, to the backlog that had existed in the previous legacy system. CMS’s oversight of states’ use of 90/10 funding largely mirrored—but further modified—its existing oversight of states’ MMIS IT changes, which are also eligible for a 90 percent federal match. For example, oversight of funding for changes to both Medicaid IT systems included agency review and approval of APDs, requests for proposals, contracts with consulting firms, and CMS-64 data.in light of these compressed timeframes for states to implement their Medicaid eligibility system IT changes. Specifically, the 90/10 funding gave states less than 3 years—from April 2011 to October 2013—to implement the critical success factors. In contrast, states often take more than 5 years to complete the design and implementation of major changes to their MMIS IT systems. However, CMS often modified these activities Two activities that CMS modified to accommodate the compressed timeframes were methods used to review APDs and CMS-64 spending. Expedited APD review: CMS established an expedited APD review of 30 days rather than the 60 days allowed for MMIS APD reviews. According to CMS officials, the expedited review enabled states to access 90/10 funding more quickly, enabling them to issue RFPs for consulting firms that will plan and implement the new technology for Medicaid eligibility IT systems changes. CMS also provided states with an APD checklist to minimize requests for additional information, and streamlined its review and approval of RFPs and states’ contracts with consulting firms. Enhanced review of CMS-64: CMS added new lines to the CMS-64 for states to separately report state and contractor expenditures for Medicaid eligibility IT system changes. To provide more timely information on the amount of 90/10 funding that had been spent, CMS implemented a new financial management process in 2013 to monitor funding for Medicaid eligibility IT system changes each federal fiscal year. According to CMS officials, this effort aligned states’ approved APD budgets with expenditure data in CMS’s financial management system to ensure that states did not exceed the amounts they were approved for each fiscal year. If a state exceeded or did not spend its budgeted amount, CMS would adjust the approved amount of 90/10 funding for the following year. In addition to modifying existing oversight practices, CMS followed new practices defined by its Enterprise Life Cycle framework to review the progress that states were making to implement Medicaid eligibility IT system changes, which focus on incremental reviews at distinct stages, or “gates.” These practices differ from CMS’s practice of certifying MMIS IT changes after the new system is operational for 60 days. To progress through each of the three gates (planning, design, and implementation), states were required to submit planning documents—known as artifacts— to CMS for approval. For example, to pass the planning gate, states provided the agency with finalized financial management and performance measurement plans; for the design gate, states submitted system design and change management plans; and for the implementation gate, states submitted a finalized information security risk assessment plan. Depending on the scope of states’ changes, the artifacts required by CMS varied. CMS developed templates for many of these artifacts to facilitate state development of them, and encouraged collaboration among states by making documents available through the new Internet-based repository known as the CALT. CMS intended this tool to be a vehicle for collaboration among states, allowing them to share source code and other information and make use of others’ approaches as a model for their own implementation. While Minnesota officials found that the CALT fulfilled this purpose by assisting them in connecting with other states using the same contractor, half the states we reviewed found it unwieldy and difficult to navigate. As a final step in the implementation gate, CMS conducted an operational readiness review wherein states demonstrated their new eligibility IT systems and readiness to implement the critical success factors. Based on these readiness reviews, CMS either approved the state’s system or granted a conditional approval pending additional state action. In some states, CMS held more than one operational readiness review reflecting the phased approach some states took to implement system changes. For example, because New Mexico implemented its integrated eligibility system in phases, CMS held two operational readiness reviews for the state and granted conditional approval after the first review, requiring the state to conduct further testing on its application transfer function. While this incremental review facilitated implementation and reflected unique circumstances of states’ Medicaid programs, our prior work that focused on the development of the FFE found that partial CMS reviews of system changes did not ensure that required approvals occurred in a timely fashion. State officials also identified challenges they experienced with aspects of this new oversight framework, which were often exacerbated due to the compressed timeframes that states had to implement the IT system changes. For example, officials from Pennsylvania said that they received little feedback from CMS on their gate presentations despite significant time and resources that the state spent preparing for such gate reviews. According to Pennsylvania officials, the CMS contractors who participated in the gate reviews were unfamiliar with the state’s IT system and thus were unable to provide the state with actionable feedback during the early gates reviews. Additionally, because the life cycle framework was a new approach, some states we reviewed did not fully understand the requirements. For example, New Mexico officials noted that they did not always know what was required at each gate and likened the process to “building a car as it is driving down the road.” Overall, however, CMS’s new approach for reviewing IT systems through the Enterprise Life Cycle framework created some positive changes, according to CMS and state officials. For example, prior to the framework, CMS reviewed documents and monitored system functions after states had implemented their new systems. Under these circumstances, any deficiencies identified by CMS had to be adjusted before CMS would approve any ongoing funding for system maintenance. According to CMS and state officials, this retrospective review and certification was costly and time consuming because it occurred after the changed systems were operational. Officials from both New Mexico and Kansas agreed and noted that the new gate review process allowed them to make technical changes throughout the process rather than at the end, allowing for improved project management. Officials from North Carolina, Kansas, and New Mexico also noted that these reviews largely mirrored their internal oversight processes, thus allowing them to use internal documents to meet certain federal requirements and minimize duplicate efforts. We provided a draft of this product to HHS for comment. In its written comments, reproduced in appendix II, HHS concurred with our findings and noted that supporting the Medicaid eligibility and enrollment process, as well as aiding IT changes in the states, continues to be among its ongoing priorities. The Department stated that 90/10 funding is an important federal investment to provide states the resources needed to make the systems improvements envisioned by PPACA. The Department also highlighted actions it has undertaken to expedite states’ access to 90/10 funding and to enhance its review of related state spending, among other activities. In addition, HHS provided technical comments that were incorporated, as appropriate. We are sending a copy of this report to the Secretary of Health and Human Services. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The Centers for Medicare & Medicaid Services (CMS) expanded the availability of an enhanced federal financial participation (FFP) matching rate of 90 percent—which we refer to as 90/10 funding—to states’ expenditures related to the design, development, and installation of new or improved Medicaid eligibility IT systems incurred from April 19, 2011, through December 31, 2015. States are also eligible to receive a 75 percent FFP indefinitely for costs associated with the maintenance and the operation of Medicaid eligibility systems that have been upgraded to meet applicable standards and conditions by December 31, 2015. States report these expenditures on the CMS-64—the form that states complete quarterly to obtain federal reimbursement for services provided or administrative costs incurred under the Medicaid program. Table 3 summarizes total state reported spending on Medicaid eligibility IT system changes through the quarter ending September 30, 2014. In addition to the contact named above, Susan T. Anthony, Assistant Director; Carolyn Fitzgerald; Caroline Hale; Anne Hopewell; Drew Long; JoAnn Martinez-Shriver; Vikki Porter; and Hemi Tewarson made key contributions to this report.

Summary: Medicaid eligibility IT systems play a key role in states' efforts to coordinate eligibility and enrollment processes for Medicaid, the Children's Health Insurance Program, and health insurance exchanges, as required by the Patient Protection and Affordable Care Act (PPACA). However, many states' eligibility IT systems were outdated and lacked the technical capacity to support such efforts. CMS expanded the availability of a federal financial participation matching rate of 90 percent (90/10 funding) to states for costs associated with such IT system changes. With these funds, CMS required states to implement certain requirements—known as critical success factors—by October 1, 2013. GAO was asked to provide information on states' receipt and use of these funds and related federal oversight. This report examines: (1) 90/10 funding states have spent on eligibility IT system changes; (2) states' use of this funding to implement critical success factors, and whether any implementation challenges remain; and (3) CMS's oversight of this funding and related system changes. GAO analyzed state-reported expenditures of 90/10 funding from June 30, 2011, through September 30, 2014; interviewed state Medicaid officials from six states, which were selected from states reporting the most expenditures of 90/10 funding; reviewed relevant laws, regulations and CMS guidance; and interviewed CMS officials. In responding to a draft of this report, HHS concurred with our findings and provided technical comments that were incorporated, as appropriate. Reported spending across all 50 states and the District of Columbia totaled more than $1.8 billion for Medicaid 90/10 funds—funds for eligibility information technology (IT) system changes—through September 30, 2014. Spending has grown steadily, with the most significant increases over the most recent quarters. According to the Centers for Medicare & Medicaid Services (CMS), 34 states used 90/10 funds to implement full system replacements of their eligibility systems, while 17 states used these funds to implement modifications to their existing systems. Using alternative approaches that reflected unique program aspects, selected states reported implementing most factors identified by CMS as being critical to enrolling individuals by October 1, 2013. However, the requirement that states transfer—send and receive—applications with the federally facilitated exchange (FFE) was the most challenging factor for states to implement, and none of the 36 states using the FFE was able to do so by October 1, 2013. One year later, 4 states remained unable to transfer applications one or both ways, but CMS continues to work with them to ensure implementation as soon as possible. CMS modified its existing oversight to expedite states' access to these 90/10 funds and to enhance its review of state spending. CMS also followed a new practice for incrementally reviewing IT system changes. While selected states were not always clear on new requirements under the framework, they appreciated such timely reviews, enabling them to make technical changes throughout the process.