Medicaid and CHIP Program System

• PIA Validation (PIA Refresh/Annual Review)
• Other - System Re-authorization

Medicaid and CHIP (Children’s Health Insurance Program) Program (MACPro) Appian
No major changes. All changes are normal system maintenance updates.

Children's Health Insurance Program Annual Reporting Template System (CARTS)
No major changes.

Statistical Enrollment Data System (SEDS)
No major changes.

Managed Care Reporting (MCR)

No major changes.

Quality Measures Reporting (QMR)
No major changes. 

Money Follows the Person (MFP)

Newly added application since the last PIA. MFP now allows saving and submission of report data.

One Medicaid and CHIP Program System (OneMAC)

OneMAC system was upgraded and moved to a new application and architecture to continue to make it usable going into the future.

Managed Care Review (MC-Review)

This is the first PIA completed for this project. Newly added application since the last PIA.

eRegulations (eRegs)
Integration with CMS IDM Okta. Center for Medicaid & CHIP Services (CMCS) employees and contractors can request reader, editor, or admin user roles via the EUA job code system. EUA job code applications are reviewed and approved or rejected by the CMS Product Owner for this application.

Home & Community Based Services (HCBS)

Newly added application since the last PIA. HCBS now allows saving and submission of report data.

Medicaid and CHIP (Children’s Health Insurance Program) Program (MACPro) Appian
The Medicaid and CHIP (Children’s Health Insurance Program) Program system (MACPro) is used by both State and CMS officials to improve the State application and Federal review processes, improve Federal program management of the Medicaid and CHIP programs, and standardize Medicaid program data. MACPro automates the process for States to submit and amend their Medicaid State Plans, Medicaid waiver programs, CHIP plan information, and State Medicaid Health Information Technology Plans (SMHPs). 

MACPro automates the uploading of States’ planning documents (SPD), State Plan Amendments (SPA) and Advanced Planning Documents (APDs), as well as applications and amendments to their Medicaid and CHIP demonstrations, and grant programs.

Children's Health Insurance Program Annual Reporting Template System (CARTS)
The Children's Health Insurance Program (CHIP) Annual Reporting Template System (CARTS) is a web-based application used by the Centers for Medicare and Medicaid Services (CMS). Section 2108(a) and Section 2108(e) of the Social Security Act (SSA) provides that the states must assess the operation of their state child health plan each fiscal year, and report to the Secretary by January 1 following the end of the fiscal year, on the results of the assessment. In addition, the state must assess the progress made in reducing the number of uncovered, low-income children. National Academy for State Health Policy (NASHP) assists the states and CMS in coordinating efforts to continually analyze Title XXI annual reports for the defined purposes.

Statistical Enrollment Data System (SEDS)
The primary activity of the MACPro Data Collection Tool (MDCT) Statistical Enrollment Data System (SEDS) application is to create an information system to track and report on the Children’s Health Insurance Program (CHIP) quarterly and annual enrollment numbers.

Managed Care Reporting (MCR)

MCR is the CMS MDCT reporting application for collecting state-reported data related to Medicaid Managed Care program reports, including Managed Care Program Annual Report (MCPAR), Medical Loss Ratio (MLR), and Network Adequacy and Access Assurances Report (NAAAR). It stores the templates for the three reports, as well as a help page to reach the MDCT help desk. Users access the application via Identity Management System (IDM) and are assigned roles that correspond to their permissions. State users can enter report data and submit data to CMS.

Quality Measures Reporting (QMR)
MDCT-QMR contains web forms for states to input information about their collected data regarding Medicaid and CHIP: 

Edit: Edit the annual measures based on State and Year selected. 

Submit: Submit the annual measures based on State and Year selected. 

View: View the annual measures based on State and Year selected. 

Export measures to a PDF: Export the answers for the state and year selected to a PDF. 

Money Follows the Person (MFP)

MFP is the CMS MDCT reporting application for collecting state-reported data related to Medicaid Money Follows the Person program reports, including MFP Work Plan (WP), and MFP Semi-Annual Progress Report (SAR). It stores the templates for the three reports, as well as a help page to reach the MDCT help desk. Users access the application via IDM and are assigned roles that correspond to their permissions. State users can enter report data and submit data to CMS.

One Medicaid and CHIP Program System (OneMAC)

The core function of the OneMAC Foundations application is to establish an automated information system, aimed at replacing the existing manual procedure for submitting, reviewing, and adjudicating State Plan Amendments (SPAs) and Policy Waivers, which currently relies on email-based processes. This innovative system offers a unified platform for submission and review, effectively linking metadata with SPA and Waiver submissions.

Furthermore, the system plays a pivotal role in enhancing information dissemination and integration. It seamlessly publishes SPA submission events to the internal MACPro BigMAC system, facilitating real-time updates and tracking. Additionally, the application is designed to transmit user submission data to the SEA Tool system, ensuring a streamlined flow of essential information.

Managed Care Review (MC-Review)
Managed Care Review (MC-Review) is used by members of state governments and members of Managed Care Group (MCG) in CMS. 

MC-Review is securely hosted within the Amazon Web Services (AWS) cloud environment, utilizing a robust 3-Zone AWS Security Group setup to manage and route traffic effectively. MC-Review is developed as a Single Page Application using the React framework and statically distributed as a single JavaScript bundle run in users’ browsers. Users authenticate using the CMS Identity Management system (IDM) which allows them to submit and review using the system. The web app calls Application Programming Interface (APIs) served by AWS lambdas which read and write data to an AWS Relational Database Service (RDS) Postgres instance.

eRegulations (eRegs)
eRegulations is a web application that helps CMCS staff find and interpret legislation, regulations, sub regulatory guidance, and other policy-related materials. The website displays relevant sub regulatory guidance alongside Medicaid regulations, which is not available in other regulations reading tools such as eCFR (Electronic Code of Federal Regulations).

Home & Community Based Services (HCBS)

Home & Community Based Services is an application that allows users to access and complete the webforms for Quality Measure Set (QMS), Timely Access Report (TA) and Critical Incident Report (CI), as well as a help page to reach the MDCT help desk. It includes a static landing page that contains information related to each of the reports, due date information, and navigation to the report dashboards and webforms, where users can submit and review data for reports. Users access the application via IDM and are assigned roles that correspond to their permissions. The data collected assists CMCS in monitoring and managing grantee progress and identifying challenges and improvement opportunities.

MACPro (Appian)

The MACPro system collects and stores Medicaid and CHIP program information such as reports on the quality of care; amendments to the Medicaid and CHIP programs within each state; amendments to the administration and benefits, waiver program, types of medical care delivery systems, payment methods and other related operational information. It does not include any details or identifying information about Beneficiaries or Providers.

MACPro stores the user’s contact information, which includes First/Last name, Email, Phone number, CMS users Group/Division, MACPro role and attributes that drive user access to MACPro functionalities.

CARTS
The system AWS accounts will collect, store, and share the same data previously collected, stored, and shared within the existing AWS account. Other than the AWS account, there will be no changes to how the data is stored nor any new data types.

Statistical Enrollment Data System (SEDS)
States record their enrollment numbers by age range on a quarterly basis at the end of each fiscal quarter as well as annually at the end of the fiscal year. This system is complementary to the MDCT CHIP Annual Report Template System (CARTS). SEDS converts an existing paper data collection process into web-based application. It also is designed to provide the reporting and exporting of survey answers into a PDF template.

Managed Care Reporting (MCR)

The system stores all saved and submitted report data and respective timestamps, along with the name associated with the IDM profile which undertook the action. This data is stored indefinitely.

Quality Measures Reporting (QMR)
MDCT-QMR contains web forms for states to input information about their collected data regarding Medicaid and CHIP.

Money Follows the Person (MFP)

The system stores all saved and submitted report data and respective timestamps, along with the name associated with the IDM profile which undertook the action. This data is stored indefinitely.

One Medicaid and CHIP Program System (OneMAC)

First name, Last Name, Company Email, Generic information related to Medicare and Medicaid requests, rewards and statuses.

MC-Review

Authorize client credentials, stored until manually deleted.

session data: stored temporarily for the duration of a user’s session

This app indefinitely stores:

User account information: full name, IDM role, division assignment and email address.

When users need to lose access to the system their IDM roles are revoked.

All contract and rate submission form field inputs, uploaded documents and documents meta data. Documents may include questions and answers, and rating information including financial or contract specific information. Contact data on submissions may include full name, title, email address, and actuarial firm name.

System configuration settings, such as email notification settings, help desk contact information, and file storage URLs.

Submission activity and audit information such as submission history, user activity logs, document access logs etc. All error logs.

eRegulations (eRegs)
This application indefinitely stores:

Text and metadata of public regulations and Federal Register documents, retrieved from public Application Program Interface (API)s offered by eCFR and the Federal Register.

Metadata about policy-related documents published by CMS, HHS, and other public sources relevant to Medicaid & CHIP, entered by contractors on this team.

Credentials for contractors who edit document metadata in this application: username created by a system administrator, and a password created by a system administrator and then immediately changed by the individual. When a contractor leaves the project, a system administrator deactivates the account; the username remains in the system, but the individual cannot log into the account. There are fewer than 15 accounts in this application.

Home & Community Based Services (HCBS)

The system stores all saved and submitted report data and respective timestamps, along with the name associated with the IDM profile which undertook the action. This data is stored indefinitely.

MACPro (Appian)

MACPro automates the process for States to submit and amend their Medicaid State Plans,
Medicaid waiver programs, CHIP plan information, and State Medicaid Health Information Technology Plans (SMHPs). This provides the mechanism for CMS to review and approve any changes to the functions of the programs such as the quality of care; amendments to the Medicaid and CHIP programs within each state; amendments to the administration and benefits, waiver program, types of medical care delivery systems, payment methods and other related operational information.
MACPro currently collects, maintains, or shares the following information:
   Medicaid State Plan Health Homes program data
   Medicaid State Plan Eligibility & Administration program data
   Adult, Child and Health Homes Quality Measure for each Federal Fiscal Year
   User roles and profile

CARTS

The AWS accounts will collect, store, and share the same data previously collected, stored, and shared within the existing AWS account. Other than the AWS account, there will be no changes to how the data is stored nor any new data types.

Statistical Enrollment Data System (SEDS)

This system is complementary to the MDCT CHIP Annual Report Template System (CARTS). SEDS converts an existing paper data collection process into web-based application. It also is designed to provide the reporting and exporting of survey answers into a PDF template

Managed Care Reporting (MCR)

The application provides state users with the ability to save and submit report data for each of the three MCR reports (MCPAR, MLR, NAAAR). When reported, the gathered information will enable CMCS to better monitor and support state efforts in improving managed care program performance.

Data is not requested or stored that pertains to individuals, rather the data requested and stored pertains to state managed care programs and entities. All information is collected in aggregate. 

Quality Measures Reporting (QMR)

MDCT-QMR contains web forms for states input information about their collected data regarding Medicaid and CHIP.

Money Follows the Person (MFP)

The application provides state users with the ability to save and submit report data for each of the MFP reports (WP, SAR). When reported, the gathered information will enable CMCS to better monitor and support state efforts in improving managed care program performance.

Data is not requested or stored that pertains to individuals, rather the data requested and stored pertains to state managed care programs and entities. All information is collected in aggregate.

One Medicaid and CHIP Program System (OneMAC)

The OneMAC system collects First name, Last Name, Company Email while connecting data from States to help CMCS make informed decisions about program oversight.

MC-Review

MC-Review facilitates the review and approval of Medicaid managed care contracts and rate certifications between state agencies and the Centers for Medicare & Medicaid Services (CMS). The system collects, maintains, and shares information to support federal oversight of state Medicaid programs and ensure compliance with regulatory requirements.

Each state user's data (name, email address, state assignments, activity data) is stored distinguish between users and track submission activities for accountability.

Each CMS user's data (name, email address, state assignments, activity data) is stored to distinguish between users, track reviewer actions, and maintain audit trails of federal review decisions.

A state user submits contract and or rate data in a submission(s), then the CMS users can see all this data and perform actions on the submission, such as unlocking, or withdrawing it. Question and answer documents provide a way for the state user and CMS user to send questions and corresponding answers back and forth, without using email.

State contact data is recorded on submissions to allow CMS to message contacts directly for follow-up questions or otherwise discuss the submission.

Rate and actuary information is crucial for the review of rates and for communication with actuaries if questions arise. Rate data is also pulled via an Application Program Interface (API) into the ARMS app for further evaluation.

 eRegulations (eRegs)

The application stores and displays policy-related text and metadata to help CMCS staff users do policy research.

CMCS staff and contractors can request EUA job codes with reader, editor, or admin roles. This application integrates with CMS IDM Okta. When a person with an approved job code logs into this application, it retrieves the person's email address and name from IDM and stores it in the application.

Contractors on the team use EUA credentials with admin roles, or a unique username and password, to log into the application's metadata editing tool, to help keep the policy-related information up to date for users. CMCS staff may also request editor access and log in to update policy-related information.

A system administrator creates a username for each contractor on the team with an abbreviation derived from the contractor's name.

The application keeps an audit log of content changes by all users, so that a change can be correlated with an individual user.

When offboarding a contractor who has a username and password account, the system administrator deactivates the individual's account, instead of completely deleting it, to preserve the integrity of the audit log.

Home & Community Based Services (HCBS)

The application provides users with the ability to save and submit report data for each of the HCBS reports (QMS, CI, TACM). When reported, the gathered information will enable CMCS to better monitor and support state efforts in improving managed care program performance.

Data is not requested or stored that pertains to individuals, rather the data requested and stored pertains to state managed care programs and entities. All information is collected in aggregate.

• Name
• Date of Birth
• Legal Documents
• E-Mail Address
• Mailing Address
• Phone Numbers
• Other - MACPro (Appian)First / Last nameEmail addressPhone numberCMS users Group/DivisionCARTSN/AStatistical Enrollment Data System (SEDS)N/AManaged Care Reporting (MCR)N/AQuality Measures Reporting (QMR)N/AMoney Follows the Person (MFP)N/AOne Medicaid and CHIP Program System (OneMAC)First name, Last Name, Company EmailMC-ReviewName, E-Mail Address, Legal DocumentseRegulations (eRegs)Name and email address for CMCS staff and contractors who log in using CMS IDM Okta. Email address and abbreviated name for contractors who log in with username and password. Home Community Based Services (HCBS)N/A

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Other - MACPro (Appian)State UsersCMS Regional Office UsersCMS Central Office UsersCARTSN/AStatistical Enrollment Data System (SEDS)N/AManaged Care Reporting (MCR)Employees, Business Partners/Contacts (Federal, state, local agencies)Quality Measures Reporting (QMR)N/AMoney Follows the Person (MFP)N/AOne Medicaid and CHIP Program System (OneMAC)OneMAC Users (Federal/state/local agencies):State UsersCMS Regional Office UsersCMS Central Office UsersMC-ReviewEmployees, Business Partners/Contacts (Federal, state, local agencies)eRegulations (eRegs)Employees, Business Partners/Contacts (Federal, state, local agencies)Home & Community Based Services (HCBS)N/A

MACPro (Appian)

The PII data in MACPro is used for following:

Username to show Point-Of-Contact, User action information on User Interface and System reports

Email address to send notifications

Phone number for Helpdesk to reach out to User

CARTS

N/A

Statistical Enrollment Data System (SEDS)

N/A

Managed Care Reporting (MCR)

N/A

Quality Measures Reporting (QMR)

N/A

Money Follows the Person (MFP)

N/A

One Medicaid and CHIP Program System (OneMAC)

The PII data in OneMAC is used for following:

Username to show Point-Of-Contact, User action information on User Interface and System reports

Email address to send notifications

Also used for user access to the application

MC-Review

Identification for the purpose of tracking the history of actions for audit purposes and accountability for actions completed in the system.

eRegulations (eRegs)

Enable employees and contractors to have user accounts that allow them to view and manage policy-related documents in the application. Enable associating user accounts with changes to documents and metadata for audit logging purposes.

Home & Community Based Services (HCBS)

N/A

• Online

• Within the OPDIV
• State/Local/Tribal
• Other - MACPro (Appian) PII is sources from CMS Identity Management System (IDM) when a user successfully authenticates and is granted access to the MACPro system.eAPDUser provided through the EUA process. Okta supplies all the PII that is stored in the system.

MACPro (Appian)

During the first attempt to register and every time that user accesses the CMS Identity Management System (IDM) and MACPro the user must agree to the Terms & Conditions of the usage. As part of the User Terms & Conditions, it is mentioned that the user should not have any reasonable expectation of privacy regarding any communication or data transiting or stored on these systems. The user data will be monitored, intercepted, searched and seized any communication or data transiting or stored on this system at any time and for any lawful Government purpose. The notification process occurs at the IDM new user registration screen and then subsequently at the user access screen of IDM.

CARTS

N/A. PII is not collected.

Statistical Enrollment Data System (SEDS)

N/A, PII is not collected.

Managed Care Reporting (MCR)

N/A. PII is not collected.

Quality Measures Reporting (QMR)

N/A. PII is not collected.

Money Follows the Person (MFP)

N/A. PII is not collected.

One Medicaid and CHIP Program System (OneMAC)

During the first attempt to register and every time that user accesses the CMS Identity Management System (IDM) and OneMAC the user must agree to the Terms & Conditions of the usage. As part of the User Terms & Conditions, it is mentioned that the user should not have any reasonable expectation of privacy regarding any communication or data transiting or stored on these systems. The user data will be monitored, intercepted, searched and seized any communication or data transiting or stored on this system at any time and for any lawful Government purpose. The notification process occurs at the IDM new user registration screen and then subsequently at the user access screen of IDM.

MC-Review

The application's notification is carried out by the IDM login system itself. Login is completed via IDM, which requires users to accept the Terms & Conditions, which state clearly that information will be recorded and that there is no reasonable expectation of privacy when using the system.

eRegulations (eRegs)

This is done via CMS IDM Okta.

Home & Community Based Services (HCBS)

N/A. PII is not collected.

MACPro (Appian)

The ability to opt-out of the collection of PII is handled at the CMS IDM Okta level. Any individual seeking access must first have an IDM account. The users must accept the Terms & Conditions before accessing the MACPro application. The Terms & Conditions advises the user that they are accessing a U.S. Government system and there should be no reasonable expectation of privacy.

CARTS

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

Statistical Enrollment Data System (SEDS)

N/A. PII is not collected directly from users. Access is handled via CMS EUA. Requesting a job code for the application and using the application are both optional.

Managed Care Reporting (MCR)

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

Quality Measures Reporting (QMR)

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

Money Follows the Person (MFP)

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

One Medicaid and CHIP Program System (OneMAC)

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

MC-Review

PII is not collected directly from users. Access is managed through CMS IDM Okta. Users may opt out by declining to provide their email address; however, an email address is required to enable system generated notifications and to allow CMS users to contact state users associated with a submission under review.

eRegulations (eRegs)

PII is not collected directly from users. Requesting a job code for the application and using the application are both optional.

Home & Community Based Services (HCBS)

N/A. PII is not collected directly from users. Access is handled via CMS IDM Okta. Users may choose to request access to applications via IDM roles or decline if they don’t want to provide their information/contacts to the application.

• Users: MACPro users may look up other users for the purpose of assigning tasks within the application business workflow. MACPro users may also send messages to other users within the application as part of standard business operations. Users have access to their own PII, which is maintained and reviewed through CMS IDM/EUA. This access allows users to verify and update their information as needed for account management and system access.
• Administrators: Authorized MACPro administrators have access to PII for the purposes of user communications, system maintenance, and user account management, as well as other system administration functions necessary to support system operations.
• Contractors: CMS direct contractors, in their role as system administrator, will have access to PII information for user communications, system maintenance, and user account management.

PII in the system is protected through a combination of administrative, technical, and physical controls. 

Administrative: Administrative controls include CMS policies and procedures, role-based access approvals through CMS IDM Okta, annual privacy and security training requirements, and periodic access reviews. 

Technical: Technical controls include role-based access controls, authentication via IDM Okta, encryption of data in transit and at rest, audit logging, and system monitoring to detect unauthorized access or activity. 

Physical: Physical controls include CMS-approved data center protections, such as facility access controls, surveillance, and environmental safeguards, which prevent unauthorized physical access to system infrastructure.

MACPro (Appian)

MACPro

CARTS

CARTS

Statistical Enrollment Data System (SEDS)

SEDS

Managed Care Reporting (MCR)

MCR

Quality Measures Reporting (QMR)

QMR

Money Follows the Person (MFP)

MFP

One Medicaid and CHIP Program System (OneMAC)

OneMAC

MC-Review

MC-Review

eRegulations (eRegs)

N/A – Internal to CMS only

Home & Community Based Services (HCBS)

HCBS