Medicaid Enterprise Systems (MES) IT Standards Request for Information.pdf

Medicaid Enterprise Systems (MES) IT Standards – Request of Information

I. Background

The Centers for Medicare & Medicaid Services (CMS) is committed to modernizing the Medicaid Enterprise Systems (MES) to improve interoperability, promote modularity, and drive better health outcomes for Medicaid beneficiaries. This commitment involves a strategic shift towards standards-based, commercial-off-the-shelf (COTS) modular solutions and cloud-based technologies, moving away from monolithic, “one-off” custom-built systems. These forthcoming IT standards are part of a larger initiative to shape and evolve a reusable and modern Medicaid technology ecosystem. This evolution is guided by federal regulations, including those at 42 CFR Part 433 and Part 95, which govern Medicaid cost allocation and system requirements.

The MES ecosystem is structured around a distributed federal-state model in which states exercise significant autonomy over IT investment decisions and vendor procurement, while CMS provides technical assistance, strategic oversight, financial stewardship, and policy guidance. However, this framework has not prevented, and in some ways has contributed to, a fragmented and aging technology landscape with several distinct and compounding problems: siloed modules and systems that cannot easily communicate with one another, unnecessary and unintended variability across similar platforms, where states performing identical Medicaid functions have implemented widely divergent technical solutions, and vendor lock-in driven by aging infrastructure that forces costly workarounds and limits the ability to adopt new capabilities or transition to modern vendors. Recent reviews of state Advance Planning Documents (APDs) and system certification packages have reinforced these concerns, surfacing recurring technical deficiencies and persistent misalignments with federal health IT goals.

Together, these compounding problems drive duplicative costs, impede modernization, and delay implementation of critical policy changes. Addressing them will require a unified approach that reduces siloing, establishes consistent standards across similar platforms, and creates clear pathways for states to modernize legacy systems without being constrained by entrenched vendor relationships or outdated architectures.

In response, CMS is launching a new MES IT Standards initiative to establish clear, outcome-driven technical standards for data exchange, system integration, and technical architecture. The program aims to align state-level MES implementations with modern technology paradigms and commercial best practices, such as the use of HL7 Fast Healthcare Interoperability Resources (FHIR) and security frameworks from the National Institute of Standards and Technology (NIST).

This initiative will be managed through a phased approach: (1) Identify and analyze the current landscape; (2) Develop and collaborate on new standards; (3) Implement and support state adoption; (4) Monitor for compliance and effectiveness; and (5) Report on national progress and key metrics. This RFI is a critical component of the initial "Identify" phase, designed to gather insights that will shape the initiative's foundation and ensure that the forthcoming standards are realistic, effective, and respectful of the federal-state partnership. This initiative is not a one-time effort but an ongoing and evolving commitment, one that CMS will continually refine based on experience and stakeholder input, to provide states and vendors with clear expectations and direction, holding them accountable for delivering and continuously improving modern, streamlined systems that achieve real-time data exchange, reduced silos, improved resource efficiency, and stronger capacity to implement critical policy changes, ultimately improving the Medicaid beneficiary experience and access to care.

II. Solicitation for Public Comment

CMS seeks feedback from all MES stakeholders to inform the development and implementation of the MES IT Standards Program. We invite input from State Medicaid Agencies, MES technology vendors, systems integrators, Standards Development Organizations (SDOs), healthcare providers, and other industry experts.

The goal of this RFI is to gather specific, actionable information to ensure the program effectively addresses the most significant barriers to MES transformation. We seek to understand which elements of the current ecosystem are working well, which require improvement, and how CMS can best support states and vendors in transitioning to a more standardized, interoperable, and cost-effective future.

To aid in our understanding of the submitted responses, please be clear and concise and preface your responses with the corresponding question label (e.g., SA-1, V-2). The RFI will be open for 45 days from the date of posting. Please submit responses via email to MACBIS-Enterprise-Services@cms.hhs.gov and aaron.blackshire@cms.hhs.gov.

mailto:MACBIS-Enterprise-Services@cms.hhs.gov

A. Definitions for Terms Used in This RFI

Term - Definition

Advanced Planning Document (APD)

The document used by states to request Federal Financial Participation (FFP) for the costs of planning, designing, developing, or acquiring a new or replacement system for the Medicaid program.

Interoperability The ability of different information systems, devices, and applications to access, exchange, integrate, and cooperatively use data in a coordinated manner.

Medicaid Enterprise Systems (MES)

Refers to the comprehensive suite of IT systems, modules, services and processes that collectively support the administration, management, and monitoring of Medicaid programs within a state.

Modularity A system design approach where functionality is divided into independent, interchangeable modules that can be individually developed, procured, and implemented.

Streamlined Modular Certification (SMC)

The outcome-based process used by CMS to certify that state MES modules meet federal requirements.

Technical Assistance

(TA)

Support provided by CMS to states, such as reference architectures, implementation playbooks, and subject matter expertise, to facilitate the adoption of new standards and technologies.

B. Questions for State Medicaid Agencies

ID Question

SA-1 From a state perspective, what are the most significant technical and operational barriers you currently face in achieving MES interoperability and modularity? Please provide specific examples related to system integration, data sharing, or vendor management.

SA-2 Which industry standards (e.g., HL7 FHIR, NIST frameworks, X12) are currently underutilized in your MES but could drive significant cost savings or improvements in beneficiary outcomes if more widely adopted?

SA-3 How can CMS establish technical standards that are specific enough to ensure federal compliance and interoperability, yet flexible enough to accommodate your state's unique policy requirements and legacy system constraints?

SA-4 What specific types of federal Technical Assistance (TA) (e.g., reference architectures, pre-certified code repositories, implementation playbooks) would most effectively accelerate your state's adoption of new IT standards?

SA-5 How can CMS best integrate standards-compliance checkpoints into the existing APD and Certification lifecycle without creating unnecessary administrative burdens or delaying procurement timelines?

SA-6 What is the most effective mechanism for soliciting continuous state feedback during the drafting and refinement of new technical architectures and standards to ensure they remain practical and relevant?

SA-7 Legacy Decommissioning: How can CMS better support states in the secure archiving and decommissioning of legacy mainframe systems during the transition to modular, standards-based architectures?

SA-8 Workforce & Skills: What workforce skills or training gaps are most prevalent within your state IT teams when adopting modern standards like HL7 FHIR or cloud-native deployments, and how can federal guidance address this?

SA-9 Data Governance: How do you currently manage enterprise data governance across multiple modular vendors, and what standards would facilitate a more unified Master Data Management (MDM) strategy?

SA-10 Procurement Lifecycles: In what ways do current state procurement regulations hinder the rapid adoption of agile, COTS-based modular solutions, and what federal frameworks might alleviate these bottlenecks?

SA-11 Data Elements: What specific data elements are currently absent, inconsistently defined, or non-standardized across MES and how do these gaps impede interoperability and data sharing within states, across state lines, and with federal reporting systems, such as T-MSIS? Please describe any known root causes, impacted use cases, and any existing or proposed remediation efforts.

SA-12 Enrollment Action: Do your state Maintenance Type Codes and Reason Codes map to a standardized national list? If yes, which one? If not, what challenges or obstacles are hindering standardization?

SA-13 Plan Identifiers: Are there challenges or barriers preventing your Program from exclusively using the National Plan ID or Health Insurance Plan (HIOS) ID to identify Managed Care Organizations (MCO), instead of state-specific plan codes?

SA-14 Error Handling: Would a federally mandated, standard 824 (Application Advice) or 999 (Implementation Acknowledgment) response format improve or complicate your state’s reconciliation process with MCOs?

C. Questions for MES Vendors and Systems Integrators

ID Question

V-1 What are the primary challenges you face when attempting to align your commercial off-the-shelf (COTS) products with varying state-specific interpretations of federal MES requirements?

V-2 How can CMS best support the vendor community in developing and maintaining products that are compliant with federal MES expectations and interoperability standards?

V-3 What automated tools, frameworks, or testing harnesses could be developed or promoted by CMS to help validate your system's compliance during development and as part of the Streamlined Modular Certification (SMC) process?

V-4 From your perspective, what is the optimal process for engaging the vendor community in the development of new standards to ensure they are technically feasible and aligned with modern software development practices?

V-5 What key performance indicators (KPIs) should CMS track to measure the national maturity of MES standardization in a way that is fair and accurately reflects the contributions of the vendor ecosystem?

V-6 Vendor Lock-in & Data Portability: What standard data schemas and API structures do you recommend ensuring seamless data portability and prevent vendor lock-in when a state transitions between modular COTS components?

V-7 Cloud Security & FedRAMP: How can CMS streamline the security authorization process for cloud-based MES modules, considering FedRAMP baselines and state-specific NIST overlays?

V-8 Service Level Agreements (SLAs): What standardized performance metrics and SLAs should be uniformly adopted across the MES vendor ecosystem to measure interoperability and system uptime accurately?

V-9 AI & Automation: How are you integrating Artificial Intelligence (AI) and Machine Learning (ML) into your COTS products, and what data standardization prerequisites are necessary to maximize their effectiveness for Medicaid populations safely and ethically.

V-10 To what extent do business process analysis, business process mapping, system configuration, user acceptance testing, and organizational change management contribute to implementation complexity, schedule delays, or cost growth during MES implementations? Based on your experience, what implementation approaches, governance practices, or tools have proven most effective in translating state business requirements into configurable software solutions while maintaining project scope, schedule, and budget? Where do you see opportunities to improve consistency and reduce implementation risk?

V-11 What is the average implementation cost and timeline for your organization to implement a state-specific 834 variant? How much would standardizing these guides reduce administrative overhead?

D. Questions for Standards Development Organizations (SDOs) and Industry Experts

ID Question

SE-1 Which emerging industry or technology standards show the most promise for solving longstanding challenges in the Medicaid technology space, particularly in areas like identity management, data quality, and cloud security?

SE-2 How can CMS best structure a governance model for its standards program that allows for agile updates and versions while maintaining stability for state and vendor planning cycles?

SE-3 What strategies should CMS employ to harmonize its MES-specific standards with broader HHS and ONC interoperability rules to create a more unified health IT ecosystem?

SE-4 Based on your experience with other large-scale standardization efforts (in healthcare or other industries), what are the most common pitfalls CMS should seek to avoid in its MES IT Standards Program?

SE-5 How can CMS design its reporting and analytics strategy to efficiently collect data that minimizes the administrative burden on states and vendors while providing a clear picture of the financial and clinical impact of standardization?

SE-6 Cross-Agency Interoperability and Coordination: What are the most critical data standards, sources, and systems needed to bridge the gap between Medicaid Enterprise Systems and broader public health registries and sources (e.g., CDC, state health information exchanges, behavioral health, human and social service data)?

SE-7 Consent & Privacy: As data sharing increases via FHIR and other APIs, what emerging standards for patient consent management and data segmentation for privacy (e.g., 42 CFR Part 2) should CMS prioritize?

SE-8 Futureproofing & Tech Debt: How should CMS design its technical standards lifecycle to prevent the accumulation of technical debt as cloud architectures and integration patterns rapidly evolve?

SE-9 Identity & Access Management: What standardized frameworks for Identity, Credential, and Access Management (ICAM) would most effectively secure multi-vendor, multi-cloud MES environments while enabling frictionless access for authorized users?

III. Collection of Information Requirements

This is a request for information (RFI) only. This RFI is issued solely for information and planning purposes; it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever. Further, we are not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party's expense. Not responding to this RFI does not preclude participation in any future RFP, if one is issued.