Medicaid And CHIP Financial

The Medicaid and CHIP Financial (MACFin) system will evolve from the existing Medicaid Budget and Expenditure System (MBES)/ Children’s Health Insurance Program Budget and Expenditure System (CBES) and Incurred but Not Reported Survey System (IBNRS), which are essential systems for Federal and state administration of the Medicaid program and Children’s Health Insurance Program (CHIP). MACFin will improve the technology, functionality, and efficiency of the existing financial reporting processes.  To provide a more consolidated solution to Medicaid financial administration and oversight, it will also integrate and automate financial management processes currently external to Medicaid Budget and Expenditure System (MBES)/Children’s Health Insurance Program Budget and Expenditure System (CBES). The modernized system aims to improve the accuracy of over $550 billion in annual state-reported budget and expenditure data, which CMS (Centers for Medicare and Medicaid Services) uses to determine Federal payment amounts to states and territories for the Medicaid and CHIP programs.  Additionally, MACFin also aims to enhance the Federal and state oversight of Medicaid and CHIP expenditures to ensure that expenditures comply with federal law and regulations. MACFin will also empower the Federal and state administration to evolve efficiently with ongoing programmatic and technological changes. 

MACFin replaces several independent smaller legacy systems and tools with a new system that uses a state-of-the-art technology platform to make future enhancements and modifications. Once implemented, MACFin integrates and automates financial management processes for a consolidated solution, thereby providing improved adaptability, flexibility, functionality, and efficiency for the following systems:

Medicaid Budget and Expenditure System/State Children's Health Insurance Program Budget and Expenditure System (MBES-CBES).

Financial Information Reporting System (FIRS).

Incurred but Not Reported Survey System (IBNRS)-Medicaid and CHIP.

Disproportionate Share Hospital (DSH) Payment Financial Database.
Upper Payment Limit (UPL).
Medicaid Quality Control (MQC) Claims Processing System.

MACFin demands strict accuracy and functionality to support managing budget, accounting, and expenditure forecasts for one of the most significant line items in federal and state budgets.

The information that MACFin collects and stores is state Medicaid program financial information (budget and expenditure).   MACFin calculates Disproportionate Share Hospital (DSH) allotments and provides DSH reporting. The application will store and maintain PII (name and email addresses) it collects when users go to Portal and register. When users attempt to access the system, the user enters their usernames and passwords for system access credentials.

The Medicaid and CHIP Financial (MACFin) system will evolve from the existing Medicaid Budget and Expenditure System (MBES)/ Children’s Health Insurance Program Business and Expenditure System (CBES) and Incurred but Not Reported System (IBNRS), which are essential systems for Federal and state administration of the Medicaid program and Children’s Health Insurance Program (CHIP). MACFin will improve the technology, functionality, and efficiency of the existing financial reporting processes. 

The information that MACFin collects and stores is state Medicaid program financial information.   In its initial release, MACFin calculates Disproportionate Share Hospital (DSH) allotments and provide DSH reporting. The application will store and maintain PII (name and email addresses) it collects when users go to Portal and register. When users attempt to access the system, the user enters their usernames and passwords for system access credentials. User access is validated through Portal IDM; username and password provide access privileges to the user.

• Name
• E-Mail Address
• Other - MACFin system collects usernames and password originally, to provide users with the system access credentials. User access is authenticated through CMS Identity Management (IDM). User information is stored to send notifications to the user from the MACFin system. The information that MACFin collects and stores is state Medicaid program financial information. MACFin calculates Disproportionate Share Hospital (DSH) allotments and provide DSH reporting. When users attempt to access the system, the user enters their usernames and passwords for system access credentials. User access is authenticated through CMS Identity Management (IDM); IDM is covered by its own PIA.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)

• In-person
• Online
• Email

• Within the OPDIV
• State/Local/Tribal

• Other - N/A

Through the CMS Enterprise Portal and IDM (IDentity Management). Portal/IDM provides the guidance and control for user authentication and authorization. MACFin leverages CMS enterprise portal and IDM for user authentication. MACFin uses CMS IDM roles for initial user authorization. Fine-grained user roles and other authorization information are contained within the MACFin application. 

A Privacy Act Statement is required and provided to individuals when their information is solicited for
collection into a system of records. The information collected will be used to identify and authenticate authorized users to the application. The PII collected will not be disclosed outside the agency. The Privacy Act of 1974 provides CMS with the authority to request the information. To have access to and utilize the application, the request for information is mandatory and if the individuals opt not to provide information requested, they will not be able to access the MACFin application. 

The application will store and maintain PII (name and email addresses) it collects when users go to Portal and register. When users attempt to access the system, the user enters their usernames and passwords for system access credentials. User information is stored to send notifications to the user from the MACFin system.

If an individual has any issues will be resolved by contacting the MACFin Help Desk:

Email: MACFinHelpDesk@dcca.com;  Phone: 1-833-879-6075; 9AM-6PM Eastern.

A PII breach incident is created with the CMS IT Service Desk (410-786-2580) within 1 hour of discovery.  Analysis and action are taken to resolve the breach. Notification to the ISSO is communicated in parallel to the CMS IT Service desk notification. The loss of PII would initiate the MACFin Incident Response and Contingency Plans. The term “incident” is defined as any willfully created event, suspected event, condition, or vulnerability that could pose a threat to the confidentiality, integrity, or availability of the MACFin System or MACFin user information, information systems, applications, and data. Regardless of how the issue was found, a Service Now (CMS ITSM ServiceName) Incident will be created for tracking purposes and remediation.

The username and email are validated against the IDM repository at least once every 365 days. MACFin would encrypt data at rest using AWS Key Management Service (KMS) and be in compliance with CMS ARS requirements. All users must have an authorized username and password to enter the application. Once in the application, users can only access functions and data for which they have been explicitly granted access as documented in control AC-2 (role-based). CMS portal would provide transport encryption via HTTPS. RDS-FIPS 140 compliant encryption (data at rest). The MACFin application enforces CMS approved encryption standards in transit and at rest; Department of Health and Human Services (HHS) dictates that TLS/SSL protocols be utilized as part of HTTPS. The implementation is done by an SSL certificate that has been validated under the Cryptographic Module Validation Program. 

The MACFin application configures operating system controls to disable public "read" and "write" access to all system-related files, objects, and directories as well as files, objects, and directories that contain sensitive information.

• Administrators: System administrators have access to PII to communicate with the users via email and to manage access.

Enterprise User Administration (EUA) based Computer Based Training (CBT), Data Computer Corporation of America (DCCA) Security Awareness training, and MACFin user manuals provide training and awareness system users.

PII may only be released when authorized, there is a need to know, and adequate assurances of protection have been provided. Applicable policy mandates establishing policy regarding access to PII, including PHI are the Privacy Act of 1974, E-Government Act of 2002 (Section 208) and HIPAA.

MACFin Retention Record schedule is with Disposition Authority Number DM-0440-2015-0004-0001. For Financial Records (Programmatic), “Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized”.

The MACFin application handles and retains information within the MACFin application and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements. The MACFin team retains and audits records for ninety (90) days and archives old records one (1) year to provide support for after-the-fact investigations of security incidents and to meet regulatory and CMS information retention requirements.

Administrative:  PII is secured with user security training, separation of duties of staff having access to PII, and labeling of PII data.

Technical: PII is secured with encryption during collection transport to the MACFin database starting with SSL and then the data is encrypted at rest within the database using the AWS RDS KMS service.

Physical:  Physical security controls are inherited from the Amazon Web Services data center where MACFin related PII is stored.

The MACFin application configures operating system controls to disable public "read" and "write" access to all system-related files, objects, and directories as well as files, objects, and directories that contain sensitive information.  Internal communications within MACFin will be accomplished through inter-zone traffic being communicated over JMS (Java Message Service) from EAP (Enterprise Application Platform) in the app zone into AMQ (ActiveMQ) in the data zone. All requests from the app zone and data zone will traverse this bridge. No traffic between zones will be communicated outside of the JMS – AMQ bridge thus ensuring a control for data inter-zone. Authentication will be via https through the portal and IDM, no user connectivity to data zone. Privacy by design implies that data will be protected by technology. Data at rest will be stored in Amazon Web Service (AWS) RDS which is FIPS 140 (Federal Information Processing Standards) compliant and also encrypted at rest. The MACFin application does not process, implement and store PII according to the XLC (Expedited Life Cycle) Document Design. The MACFin application team restricts the use of portable storage and mobile devices on information systems and networks containing personally identifiable information (II), without using device ownership, media sanitization and encryption controls. 

• Session Cookies: No
• Persistent Cookies: No