MACPAC Request for Information_Data Management and Analysis.pdf

MACPAC Request for Information (RFI) on Data Management, Storage, and Analysis

Purpose The Medicaid and CHIP Payment and Access Commission (MACPAC), a Congressional Agency, seeks information through this request for information (RFI) from vendors with proven experience securely managing and analyzing administrative data and other data sources, as described below, on behalf of government clients.

Specifically, MACPAC is soliciting responses from vendors that:

• Have experience working with federal and/or state health agencies on projects that require storage, management, and analysis of data from restricted-use data sets (e.g., Medicaid claims data or other data subject to Health Insurance Portability and Accountability Act (HIPAA) protections);

• Demonstrate understanding of and experience with Medicaid and Medicare policy and data analysis;

• Operate systems that meet federal government security requirements for storing and analyzing sensitive data;

• Hold active government security certifications and/or authority to operate (ATO) from a federal agency;

and

• Have existing access, or the ability to gain access, to relevant data sources, as described below.

This request is for information and planning purposes only and should not be construed as a solicitation or as an obligation on the part of MACPAC or the federal government. Responses to this RFI are voluntary and will not be considered as offers, nor will they result in a contract, award, or commitment of any kind.

Responsive vendors grant MACPAC the right to use any information provided without restriction and without compensation. Respondents should not include proprietary or confidential information in their submissions unless explicitly requested. MACPAC reserves the right to share, reproduce, or incorporate submitted information into future solicitations or planning documents at MACPAC’s sole discretion.

Background MACPAC uses many different data sources in its analyses of Medicaid policies and programs, including administrative data, cost report data, and others. In particular, administrative data allow for detailed analyses of enrollment, spending, and utilization for populations with coverage under Medicaid or the State Children’s Health Insurance Program (CHIP). The data used are primarily federal datasets that are obtained through the Centers for Medicare & Medicaid Services (CMS), but may include data from third-party vendors. Datasets used in the past include, but are not limited to:

• Medicaid Statistical Information System (MSIS)

• Medicaid Analytic eXtract (MAX)

• Transformed Medicaid Statistical Information System (T-MSIS)

• T-MSIS Analytic Files (TAF)

• Form CMS-64, CMS-21, and CMS-37 expenditure data

• CHIP Statistical Enrollment Data System (SEDS)

• Medicaid Disproportionate Share Hospital (DSH) audit data

• Medicaid state drug utilization and drug product data

• National Plan and Provider Enumeration System (NPPES) data

• First DataBank

• Symphony Health Integrated Dataverse MACPAC also analyzes Medicare administrative data as part of its work on individuals dually eligible for Medicare and Medicaid. As part of this work, MACPAC has developed a data book on the dually eligible in conjunction with the Medicare Payment Advisory Commission (MedPAC). Medicare datasets used in the past include, but are not limited to:

• Master Beneficiary Summary File (MBSF)

• Medicare Enrollment Database

• Common Medicare Environment (CME)

• Medicare denominator file

• Common Working File (Medicare Part A, Part B, and Part D claims)

• Part D prescription drug event data

• Medicare Advantage encounter data with payment variables

• Medicare-Medicaid Linked Enrollee Analytic Data Source (MMLEADS)

• Health Plan Management System (HPMS)

• Long-term care Minimum Data Set (MDS)

• Medicare Current Beneficiary Survey (MCBS)

• Medicare Provider Analysis and Review (MedPAR)

• Healthcare Cost Report Information System (HCRIS)

Examples of data analysis tasks conducted by MACPAC and its partners include the following:

• using MSIS/T-MSIS data to calculate Medicaid enrollment and spending by eligibility group and state;

• using MSIS/T-MSIS data to analyze utilization and spending for specific types of services, such as hospitals or long-term services and supports;

• using Medicaid DSH audit reports, Medicare cost reports, and CMS-64 expenditure data to analyze DSH allotments and measures of uncompensated care; and

• using Medicare and Medicaid administrative data to create a data book with statistics on enrollment and spending for various populations who are dually eligible for Medicare and Medicaid.

Information Requested As described above, MACPAC is aware of vendors who operate secure data storage centers that implement sufficient security to protect PHI and PII, and that these data storage centers may also include environments that facilitate secure performance of analysis of these data. Interested vendors are requested to provide detailed responses to the questions for which they have relevant capabilities and experience. Responses shall address the questions below and include any other pertinent information.

System Architecture, Capabilities, and Security Features

1. Describe your system architecture, including information about its main purpose, structure, how users access the system, and general security features.

a. Please describe your system’s overall approach to data security in alignment with the Federal

Information Security Modernization Act (FISMA) and applicable National Institute of Standards and Technology (NIST) standards, including, but not limited to, NIST SP 800-53, SP 800-37, and SP 800-171. Responses should address how systems and related processes support the confidentiality, integrity, and availability of data, and how continuous monitoring, incident response, and risk management are implemented.

b. Is your system FedRAMP certified? If so, is this low, moderate or high? When was this authorization granted, and when does it expire?

c. Does your system currently have an Authority to Operate (ATO) issued by a federal agency? If so, what agency(ies) granted your ATO? When was this authorization granted, and when does it expire?

d. Do you have any other relevant certifications?

2. Describe the type of environment(s) or processes you use to perform the functions listed below. Include information regarding the security features and technical safeguards, file size and storage limitations, whether it is cloud-based, on-site, or a hybrid, and any other pertinent information.

a. Data acquisition

b. Data storage

c. Data management

d. Data analysis

e. File transfer

3. Describe your capability to host or create a remotely accessible project environment for authorized

MACPAC staff or external vendors to access and analyze Medicaid and Medicare data using statistical software. Please include information regarding

a. which software can be made available;

b. security features and technical safeguards;

c. file size and storage limitations;

d. ability to import external data sets/files; and

e. client agency staff ability to manage internal and external access to this environment.

Data Access

4. Describe your current access to restricted-use federal or state-level health data sets (e.g., T-MSIS, TAF, and Medicare MBSF)

a. If you have access, describe how you receive access or acquire the relevant data sets.

Data Storage, Management, and Analysis Capabilities

5. Describe your capability to store large datasets and create research-friendly analytic files (e.g., identifying final, paid claims) from raw data files.

6. Describe your experience managing and analyzing Medicaid and Medicare data.

a. What type of raw claims and eligibility files have you used?

b. What processes do you have to clean administrative data, assess data quality, and verify completeness of datasets?

c. What approaches has your organization used to identify program users, services, or expenditures to generate meaningful, policy-relevant quantitative output?

7. Please describe up to three recent projects where you performed (1) storage and management; and/or (2) analysis of Medicaid and/or Medicare data for a government client. Of particular interest to MACPAC are projects where both functions (1) and (2) were performed under the same contract.

How to Submit a Response Organizations’ responses to RFI questions should be submitted in a single electronic file (Word or PDF preferred) via secure online portal (https://macpacgov.app.box.com/f/06b4aa5d6a224c3fb1c69f6032f896cd) no later than 5:00 pm Eastern Time on September 19, 2025. Electronic files should be labeled according to the following file naming convention: [Responder’s Organization] MACPAC RFI response [Date of submission]. Questions regarding this RFI may be submitted via email to katherine.rogers@macpac.gov.

https://macpacgov.app.box.com/f/06b4aa5d6a224c3fb1c69f6032f896cd mailto:katherine.rogers@macpac.gov

How to Submit a Response