Medicaid and Childrens Health Insurance Program Budget and Expenditure System

• PIA Validation (PIA Refresh/Annual Review)
• Other - PIA Renewal

The Medicaid and Children’s Health Insurance Program Budget and Expenditure System (MBES/CBES) is a web-based application that Medicaid state agencies use to report budgeted and actual expenditures for Medicaid and the Children’s Health Insurance Program (CHIP) to CMS, as required for the implementation of the Medicaid portion of the CHIP Program and Title XIX and XXI of the Social Security Act. 

MBES/CBES uses the information from each state to compute the amount of Federal Financial Participation (FFP) CMS will provide to the state to fund program operations. MBES/CBES also stores the state’s historical budget and expenditure records for data analysis purposes.

Starting with the 2/15/2022 submission period, budget data is no longer submitted into MBES/CBES.  Rather, it is submitted in the Medicaid and CHIP Financial (MACFin) system. Data entered MBES/CBES for prior submission periods remains available for viewing in MBES/CBES.

The information that MBES/CBES collects and stores is state Medicaid and CHIP program financial information. The financial information is uploaded directly into the MBES/CBES system by a designated state user. MBES/CBES is made up of the following forms that the states submit quarterly to CMS.

CMS-37 - Medicaid Program Budget Report. Form CMS-37 is a financial report updated quarterly. It provides an estimate for both the current fiscal year and the budget fiscal year. After reviewing a state’s submissions, CMS provides the state with a grant award that authorizes Federal funding for that quarter. NOTE: Starting with the 2/15/2022 submission period, Form CMS-37 is no longer submitted into MBES/CBES.  Rather, it is submitted in MACFin.  Data entered MBES/CBES for prior submission periods remains available for viewing in MBES/CBES.

Form CMS-64 - Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program. Form CMS-64 is an accounting statement that contains the following information: the amount of Medicaid grant funds that have been dispersed for a given quarter, as well as past fiscal years; the recovery of funds or refunds provided; and the income earned on grant funds. 

CMS-21 - Quarterly Children's Health Insurance Program Statement of Expenditures for Title XXI. Form CMS-21 is an accounting statement that shows a state’s recorded expenditures and disposition of Federal funds. Most of the expenditures reported on this form are associated with starting and expanding health insurance coverage to include uninsured, low-income children through the CHIP. States are entitled to Federal reimbursement based on the actual expenditures shown in this form.

CMS-21B - CHIP Program Budget Report. Form CMS-21B provides states with a means to report on their program budgets and is used to estimate program expenses. Reconciliations between the projected program expenses shown in CMS-21B and the actual program expenses shown in CMS-21 are made after the period of availability for allotments has expired. NOTE: Starting with the 2/15/2022 submission period, Form CMS-21B is no longer submitted into MBES/CBES.  Rather, it is submitted in MACFin.  Data entered MBES/CBES for prior submission periods remains available for viewing in MBES/CBES.

System users are CMS employees, CMS direct contractors and specifically authorized Medicaid state agency personnel. Each user has a User ID and password to access the system. Name and E-mail address are collected to establish the user's profile in the Enterprise User Administration (EUA) authentication system process and for an alert notification purpose so that the user can receive notification of their initial/temporary password. The password for EUA and MBES-CBES application are not synchronized. All MBES-CBES users must have valid CMS ID in order to have access to application.

The MBES/CBES is an online system which allows the Medicaid state agencies to report budgeted and actual expenditures for Medicaid and the Children’s Health Insurance Program (CHIP) to CMS, as required for the implementation of the Medicaid portion of the CHIP and Title XIX and XXI of the Social Security Act. 

MBES/CBES uses the information from each state to compute the amount of Federal Financial Participation (FFP) CMS will provide to the state to fund program operations.  MBES/CBES also stores the state’s historical budget and expenditure records for data analysis purposes. 

MBES/CBES stores Medicaid and CHIP budget and expenditure information that is summarized across the various categories of service. The information contained within MBES/CBES is not broken down to the recipient level and is not considered personally identifiable information (PII). Designated state personnel upload information into MBES/CBES through the forms described below. CMS reviews and certifies the information.

CMS-37 - Medicaid Program Budget Report. Form CMS-37 is a financial report updated quarterly. It provides an estimate for both the current fiscal year and the budget fiscal year.

NOTE: Starting with the 2/15/2022 submission period, Form CMS-37 is no longer submitted into MBES/CBES.  Rather, it is submitted in MACFin.  Data entered MBES/CBES for prior submission periods remains available for viewing in MBES/CBES.

CMS-64 - Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program. It is an accounting statement that contains information about grant funding.

CMS-21 - Quarterly Children's Health Insurance Program Statement of Expenditures for Title XXI. This form is an accounting statement that shows a state’s recorded expenditures and disposition of Federal funds. States are entitled to Federal reimbursement based on the actual expenditures shown in this form.

CMS-21B - CHIP Program Budget Report. It provides states with a means to report on their program budgets and is used to estimate program expenses.

NOTE: Starting with the 2/15/2022 submission period, Form CMS-21B is no longer submitted into MBES/CBES.  Rather, it is submitted in MACFin.  Data entered MBES/CBES for prior submission periods remains available for viewing in MBES/CBES.

System users are CMS employees, CMS direct contractors and specifically authorized Medicaid state agency personnel. Each user has a User ID and password to access the system. 

• Name
• E-Mail Address
• Other - Each user has a valid User ID and password to have an access the system. Name and E-mail address are collected to establish the user's profile in EUA authentication system process and for an alert notification purpose so that the user can receive notification of their initial/temporary password. The password for EUA and MBES-CBES application are not synchronized. All MBES-CBES users must have valid CMS ID to have access to application. The financial information MBES/CBES collects and stores is state Medicaid and CHIP programs are uploaded directly into the MBES/CBES system by a designated state user.

Employees

Business Partners/Contacts (Federal, state, local agencies)

• In-person
• Online
• Email

• Within the OPDIV
• State/Local/Tribal

• Other - Not applicable. All PII in system pertains to Federal and State Agency employees or to Direct Contractors.

• Users: The system employs the concept of 'least privilege' so that only those administrators tasked with user maintenance can access the minimum amount of information necessary to perform their job. No others can access the PII.
• Administrators: System administrators have access to PII to communicate with the users via email and to manage access. System Administrators are CMS employees.
• Contractors: The system employs the concept of 'least privilege' so that only those administrators tasked with user maintenance can access the minimum amount of information necessary to perform their job. No others can access the PII. Direct Contractors can get access to PII if their help is needed to resolve a data-related issue in MBES/CBES.

MBES/CBES contains financial records. Per the Centers for Medicare & Medicaid Services (CMS) Records Schedule, Records Schedule: DAA-0440-2015-0004, financial records as kept by MBES/CBES must be maintained as indicated in the following rule:

Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized.

By design, all data entered MBES/CBES is maintained indefinitely and thus meets the requirement specified in the CMS Records Schedule.

MBES/CBES is in a virtual data center (VDC), which is a cage within a secured data center facility. Physical controls for the data center are in place such as security guards, the use of identification badges for entry, video surveillance and climate control measures. Access to the cage in which MBES/CBES is located is only granted to people who need access to the hardware in the cage.

The technical controls in place include intrusion detection and prevention technology (IDS/IPS), encryption, monitoring and system logs of activity, and virus/malicious code detection software.  

Administrative controls are role-based access, training, periodic review of user accounts and written policies and procedures.