Introduction

Medicaid and the Children’s Health Insurance Program (CHIP) provide health insurance coverage to more than 80 million people, including low-income children, families, seniors, pregnant people, and people with disabilities.[1] While Medicaid has a proven track record of providing affordable, high quality health care, stakeholders have long sought better transparency and accountability with respect to access to services.[2] The Centers for Medicare & Medicaid Services (CMS) recently finalized two key regulations: “Ensuring Access to Medicaid Services” (Access Rule)[3] and “Medicaid, CHIP Managed Care Access, Finance, and Quality” (Managed Care Rule),[4] aimed at improving access to care in Medicaid across delivery systems (fee-for-service (FFS) and managed care) and authorities (state plan and waiver services).

Most Medicaid beneficiaries (74 percent in 2021) in most states are enrolled in comprehensive, risk-based managed care.[5] But despite the large and growing role Medicaid managed care organizations (MCOs) play, monitoring FFS systems continues to be important even in states with high managed care penetration rates given the role FFS plays in delivering care to people in rural areas and people with complex medical needs. Similarly, most Medicaid benefits are provided through the state plan benefit package, but home and community-based waivers and section 1115 demonstration waivers serve an outsized role for particular beneficiary groups (e.g., people with disabilities, people with behavioral health needs, etc.). Thus, it is important that strategies to improve access to care apply regardless of the delivery system or statutory authority under which they operate. Once fully implemented, the rules will make meaningful improvements in access to care, data and payment transparency, and beneficiary engagement.

---

Effective Dates

Throughout the Access and Managed Care Rules, the applicability dates are often described as beginning on the first rating period after a specified effective date (e.g., first rating period beginning on or after July 9, 2024). Most states set their managed care contracts on either a January 1 – December 31 or July 1 – June 30 basis, though some states use September 1 or October 1 start dates. This means that, for example, in a state using a July 1 – June 30 contract year, provisions taking effect “on the first rating period on or after July 9” of a given year will actually take effect on July 1 of the following year. For more details about the specific applicability dates of each provision, see the Appendix and CMS’ applicability date charts available at https://www.medicaid.gov/medicaid/access-care/downloads/applicability-date-chart-ac.pdf and https://www.medicaid.gov/medicaid/managed-care/downloads/applicability-date-chart-mc.pdf.

---

[Note: Some provisions apply to Medicaid only whereas others apply to Medicaid and separate CHIP. Similarly, some provisions apply to FFS delivery systems, whereas others apply to managed care or both FFS and managed care. The applicability of each section is noted in italics below the heading.]

Enrollee and Stakeholder Engagement

The Access and Managed Care Rules make a number of important changes to improve enrollee and stakeholder engagement. The rules update the Medical Care Advisory Committee (MCAC) requirements and create two new advisory committees, which will include individuals enrolled in Medicaid and will provide recommendations to state Medicaid agencies. The rules will also require surveys of managed care enrollees to inform plan performance improvement and support better person-centered HCBS planning. These new provisions should help empower individuals in Medicaid to leverage their experience for program improvement.

Establishes Medicaid Advisory Committee and Beneficiary Advisory Council (§ 431.12)

[Medicaid; FFS and managed care]

 Medicaid has long-standing requirements for states to operate MCACs, stakeholder advisory committees that include individuals enrolled in Medicaid and provide the state Medicaid agency with recommendations on how to run its program. The Access Rule makes two overarching changes to the current MCAC structure. First, the MCAC is renamed “Medicaid Advisory Committee” (MAC) and numerous new details and standards are set out for MACs. Second, the rule creates a new parallel entity, the Beneficiary Advisory Council (BAC), which will also provide direct advice to the state Medicaid agency and some BAC members will also serve on the MAC. Once fully implemented, the rule will require at least 25 percent of MAC membership be comprised of BAC members.

The Access Rule specifies that BAC members can be individuals enrolled in Medicaid (including youth), as well as their families and caregivers. In addition to including BAC members, the MAC membership must include at least one of each: a consumer advocacy organization, a provider group, a managed care entity, and one other relevant state agency (the state agency is in a non-voting role). The rule requires MACs and BACs to meet at least quarterly, with at least two MAC meetings open to the public each year. BACs can choose whether their meetings are public. The Access Rule sets out important requirements for MACs and BACs, including developing bylaws and publicly posting them along with formal processes for appointing members, meeting schedules, past meeting minutes, and attendee lists (BAC members can opt out of being named in minutes and attendee lists). Under the rule, the MAC will also produce an annual report, which must be publicly posted, detailing recommendations made to the state and state responses.

The rule also expands the requirements for states to support MAC and BAC members to promote their participation. This includes financial support, which CMS clarifies includes at least reimbursement for travel, lodging, meals, and childcare when “necessary.” While broader financial support such as stipends are permissible, CMS notes they may impact countable income for eligibility purposes (expense reimbursements do not impact eligibility). Importantly, the rule also requires states to provide “research or other information needed” to support MAC and BAC members. Finally, the rule requires states to ensure that meetings are accessible (including disability and language) and that meeting times and locations are selected and varied to maximize member attendance. Effective date: The new standards for MACs and BACs take effect July 9, 2025, though the requirement to ensure 25 percent of MAC membership comes from the BAC is phased in over a three-year period.

HCBS Interested Parties Advisory Group (§ 447.203(b)(6))

[Medicaid; FFS]

 The Affordable Care Act (ACA) requires the Secretary of Health and Human Services (HHS) to issue regulations to ensure that all states develop service systems that support home and community-based (HCBS) services.[6] This includes improving coordination and regulation of providers to oversee and monitor functions to assure, among other requirements, an adequate number of qualified direct care workers to provide self-directed services. Such requirements continue to be important given ongoing access issues for direct care workers in Medicaid.[7] In addition, because Medicare generally does not cover such services, states are limited in their ability to compare payment rates to Medicare rates when considering whether payment rates are hindering access.

With the Access Rule, states will be required to establish an Interested Parties Advisory Group (IPAG) to advise and consult on fee-for-service (FFS) rates paid to direct care workers providing self-directed and agency-directed services for personal care, home health aide, homemaker services, and habilitation services provided under §§ 1905(a), 1915(i), (j), (k) state plan authorities, section 1915(c) waivers, and where applicable, 1115 demonstrations. Under the rule, the IPAG will advise and consult with the state Medicaid agency on current and proposed payment rates, HCBS payment adequacy data, and access to care metrics to ensure Medicaid payment rates are sufficient to ensure access to the selected services including a sufficiently large workforce to maintain access to services.[8] The IPAG is required to meet by July 2026 and at least every two years thereafter and include, at a minimum, direct care workers, beneficiaries and their authorized representatives and other interested parties which could include beneficiary family members and advocacy organizations. States have flexibility over member tenure, conflict of interest policies, and general operation, including whether and how the IPAG may intersect with MACs; however, the process by which a state selects IPAG members and convenes meetings must be made publicly available. Recommendations of the IPAG must also be made public within one month of being provided to the state Medicaid agency. Finally, the rule also requires states to ensure the group has access to current and proposed payment rates, available HCBS provider payment adequacy minimum performance and reporting standards, and applicable access to care metrics to make recommendations and to consider and respond to recommendations on proposed rate changes; however, the rule reiterates that recommendations are non-binding on the state and not required in advance of every state rate change. Effective date: The first meeting must be held by July 9, 2026, with subsequent meetings at least every two years thereafter.

Enrollee Experience Surveys (§§ 438.66(b)(4) and (c)(5), 457.1230)

[Medicaid and CHIP; managed care]

One measure of access to care in an MCO is the experience of its enrollees as reported by enrollees themselves.[9] Under current regulations, state Medicaid agencies must use the results of any enrollee or provider satisfaction survey, whether conducted by the agency or the MCOs, in improving the performance of their managed care programs. They are not, however, required to conduct those surveys or to post the results. Nor are they required to conduct enrollee experience surveys, which focus not on whether an MCO or its providers have met the enrollee’s expectations, but on whether something that should happen in an MCO, such as timely access to a physician or effective care coordination, actually happened.

The Managed Care Rule requires state Medicaid agencies to conduct, on an annual basis, an enrollee experience survey, and to use those results in improving the performance of their managed care programs. Section 438.358(c)(2) of the rule makes clear that state agencies, at their option, can use an External Quality Review Organization (EQRO) to conduct these surveys. In § 438.10(d)(2) the rule does not specify the survey instrument that state agencies must use but requires that whatever instrument the state selects meets the interpretation, translation, and tagline criteria so that the survey and the results are easy for enrollees to read and understand. The rule also requires state Medicaid agencies to include an evaluation of MCO performance that is based on the results of the annual enrollee experience survey in the Medicaid and CHIP Annual Program Report (MCPAR) they submit to CMS each year (and post on their own websites), as required by § 438.66(e)(2)(vii). Effective date: These requirements will take effect for contract rating periods beginning on or after July 9, 2027.

The rule applies similar new requirements to states with separate CHIP programs that contract with MCOs (as of March 2023, 27 states did so).[10]  In analyzing the adequacy of MCO networks, these states will be required to evaluate the results of the most recent annual survey of enrollee experience.  Under § 457.1207, states will also be required to post on their state Medicaid agency website comparative summary results of enrollee experience surveys specific to each MCO with which they contract. Effective date: This requirement is effective July 9, 2026.

HCBS Person-Centered Service Plans (§§ 441.301(c)(1) and (3), 441.311(b)(3), 441.450(c), 441.540(c), 441.725(c))

[Medicaid; FFS and managed care]

The Medicaid statute requires that HCBS services provided through a section 1915(c) waiver be provided pursuant to a written plan of care referred to in the Access Rule as a person-centered service plan or service plan. Previous regulations and guidance included a number of requirements related to person-centered service plans and state compliance, however, as noted in the rule, based on feedback from advocates, states, and others, there continues to be a need to standardize reporting and set minimum standards for HCBS, including ensuring necessary revisions to person-centered service plans in order for individuals receiving HCBS to remain as independent as possible and prevent adverse outcomes.[11]

Accordingly, the Access Rule sets forth a new approach to person-centered planning requirements. Under the rule, the state must ensure that every individual’s person-centered service plan is reviewed and revised at least annually, when the individual’s circumstance changes significantly, or upon request. States must: (1) complete a reassessment of functional need at least every year and (2) review and revise, as appropriate, the person-centered service plan based upon the reassessment of functional need for no less than 90 percent of individuals by July 2027 for FFS delivery systems and by the first rating period beginning after that date for managed care delivery systems. In demonstrating compliance, states must report annually to CMS on the percentage of individuals who had a reassessment of functional need completed within the past 12 months and the percentage who had their service plan updated as a result of that reassessment, which they may do through the use of statistically valid random samples. The rule applies these requirements to HCBS provided under 1915(c) waiver programs and 1915(i), (j), and (k) state plan services in accordance with the ACA requirement for states to improve coordination and regulation of HCBS services.[12] However, the requirements do not apply to HCBS delivered under 1905(a) state plan authorities, although the rule recommends states implement person-centered planning processes for all HCBS. Effective date: States must comply with the person-centered 90 percent performance levels by July 9, 2027 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date.

Access to Care

The Managed Care Rule contains a number of provisions intended to ensure that MCO enrollees have access to the services they need and to which they are entitled.  When fully implemented over the next five years, these provisions will make provider directories more useful to enrollees and establish minimum standards for appointment wait times. State agencies will be required to monitor compliance through secret shopper surveys.  In the event of noncompliance, enforcement tools will include remedy plans.

The Access Rule increases the amount of information state Medicaid agencies report to CMS relating to their HCBS waiver programs.  The new data relates to waiting lists, wait times for services, and the percentage of authorized hours for services actually received.  When reporting begins in three years, this information will give CMS and stakeholders greater visibility into the accessibility of HCBS services, whether delivered on a FFS basis or through an MCO.

Provider Directories (§ 438.10(h))

[Medicaid; managed care]

If Medicaid enrollees do not have accurate and current information about which providers are participating in an MCO’s network, they cannot make an informed choice about which MCO will best meet their needs. Currently MCOs are required to post provider directories on their websites, to make them available to enrollees, upon request, in paper form, and to update them regularly. The directory must provide information for at least the following types of providers: physicians, hospitals, pharmacies, and behavioral health providers. For each provider the directory must include the following information: name, specialty, street address, telephone number, language capabilities, accommodations for patients with physical disabilities, and whether the provider will accept new enrollees.

These requirements proved insufficient to protect enrollees from “phantom” provider networks, so Congress revised and codified them in section 5123 of the Consolidated Appropriations Act, 2023.[13] The Managed Care Rule implements these revisions. To make the provider directories more useful to enrollees, each MCO will be required to make its directory available in searchable electronic form. In addition to the information about each provider specified in current regulation, the directories must also indicate whether the provider offers covered services via telehealth and must distinguish mental health and substance use disorder providers. Shortly after releasing the rule, CMS issued a State Health Official Letter that outlines more details about the provider directory requirements.[14] To ensure the accuracy of MCO provider directories, the rule provides for secret shopper surveys. For more detail, see below. Effective dates: These new requirements apply July 1, 2025. In addition, state Medicaid agencies are required to post provider directories on their websites beginning July 1, 2026.

Appointment Wait Time Standards (§§ 438.68(e), 457.1218)

[Medicaid and CHIP; managed care]

Under current regulations, state Medicaid agencies must develop quantitative network adequacy standards for each of seven different provider types, including primary care, obstetrics/gynecology (OB/GYN), behavioral health, specialist, hospital, pharmacy, and pediatric dental. In the case of primary care, behavioral health, and specialist services, the standards must distinguish between adults and children. The regulations do not specify the quantitative standards that states must use; as a result, there is wide variation from state to state.[15]

The Managed Care Rule builds out from this. It continues the requirement under § 438.68(b)(1) that state Medicaid agencies develop a quantitative network adequacy standard for each of seven different types of providers. In addition, the rule requires state Medicaid agencies to “establish and enforce” appointment wait time standards for specific services. For routine primary care (adult and pediatric) or OB/GYN visits, appointment wait times cannot exceed 15 business days from the date of request. For routine visits for outpatient mental health and substance use disorder (adult and pediatric), the standard is 10 business days from the date of request. State Medicaid agencies may establish shorter timeframes.

The rule defines compliance with these standards for routine appointments as “a rate of appointment availability … of at least 90 percent.” That is, at least 90 percent of the requests for routine appointments result in appointments within the 10- or 15-day standard (or state-specified standard, if shorter). Whether individual MCOs meet this compliance standard will be determined by an annual secret shopper survey (see below). State Medicaid agencies will have discretion to define what constitutes a “routine” appointment. Under § 438.68(d), state agencies will also be able to grant an MCO an exception to these requirements based on the number of providers in the specialty practicing in the MCO’s service area, taking into consideration the payment rates that MCO offers. These requirements apply to separate CHIP programs by an existing cross reference at § 457.1218. Effective date: These requirements will take effect for contract rating periods beginning on or after July 9, 2027.

Secret Shopper Surveys (§§ 438.68(f), 457.1218)

[Medicaid and CHIP; managed care]

The rule’s new requirements relating to provider directories and appointment wait times will be meaningful only to the extent that MCOs comply. To monitor compliance, the rule turns to secret shopper surveys. While many state Medicaid agencies already use secret shopper surveys to help monitor MCO compliance with network adequacy requirements,[16] there is no requirement in current regulations that they do so. The rule changes this policy. It requires state Medicaid agencies to contract with an independent entity to conduct annual secret shopper surveys of each MCO’s compliance with: (1) the provider directory requirements and (2) appointment wait time standards.

Under the rule, the entity conducting the secret shopper survey must be independent of both the state Medicaid agency and the MCO subject to the survey. For purposes of assessing compliance with both the provider directory and appointment wait time requirements, the surveys must use a random sample and must include all areas of the state served by the MCO. In addition, for appointment wait time standards, the secret shopper survey must be completed for a statistically valid sample of providers. State agencies must report the results of the surveys to CMS and post them on their websites within 30 days of submission to CMS. These requirements apply to separate CHIP programs by an existing cross reference at § 457.1218. Effective date: These requirements will take effect for contract rating periods beginning on or after July 9, 2028.

Remedy Plans (§§ 438.207(f), 457.1230(b))

[Medicaid and CHIP; managed care]

Establishing new access standards for MCOs, and monitoring MCO compliance with those standards, is necessary to improving enrollee access to care, but they are not sufficient. Enforcement of MCO compliance is needed as well. Currently, CMS regulations require state Medicaid agencies to submit corrective action plans when they identify deficiencies in access to care in FFS Medicaid programs (the new Access Rule retains this provision). There is no comparable enforcement mechanism for access deficiencies in managed care Medicaid. (CMS has general authority to withhold federal matching funds in order to ensure compliance by states with federal Medicaid requirements, but the use of this authority by CMS is extremely rare.)

The Managed Care Rule establishes a new enforcement mechanism to remedy access problems in managed care: remedy plans. If either the state Medicaid agency or CMS “identifies an area in which an MCO’s … access to care under the access standards … could be improved,” the state Medicaid agency will be required to submit a remedy plan to CMS for approval. The remedy plan must “address” the identified access issue within 12 months, and the state agency must submit quarterly updates on the progress of implementation to CMS. If the remedy plan does not improve access within 12 months, CMS may require the state to continue the plan for another 12 months. No further consequence is specified. These provisions apply to separate CHIP by cross reference at § 457.1230(b). Effective date: These requirements will take effect for contract rating periods beginning on or after July 9, 2028.

HCBS Access Reporting (§§ 441.303(f)(6), 441.311(b)(4), 441.311(d)(1), 441.311(d)(2))

[Medicaid; FFS and managed care]

The majority of states employ HCBS waivers, which allow them to offer a wider range of benefits but also limit the number of people who receive services.[17] In addition, even when individuals are approved for HCBS, many often struggle to find staff to support them. As noted in the Access Rule, there is a need to improve public transparency and processes related to states’ HCBS waiting lists and standardized reporting, including timeliness of HCBS and the share of services individuals are eligible for versus services that are received.[18]

Under the rule, states must report to CMS annually on HCBS waiver waiting lists. For states that have a limit on the size of the waiver program and maintain a list of individuals who are waiting to enroll, states must report the number of people on the list and the average amount of time individuals newly enrolled in the waiver program in the past 12 months were on the waiting list. States must also report on whether the state screens individuals for eligibility prior to placing them on the list, whether the state periodically screens individuals on the list for continued eligibility, and the frequency of rescreening, if applicable. The requirement applies to 1915(c) waiver programs, 1915(j) where applicable, and 1115(a) demonstrations if they include an HCBS enrollment cap.

In addition, the rule also requires states to report to CMS annually on the average amount of time from when homemaker services, home health aide services, personal care services, and habilitation services are initially approved to when services begin for individuals newly receiving such services within the past 12 months. States must also report annually on the percent of authorized hours for such services that were provided within the past 12 months. The reporting requirements apply to such services authorized under section 1915(c), 1915(j), (k) and (i) authorities and 1115 demonstration programs (unless explicitly waived), but not 1905(a) state plan authority, delivered under both FFS and managed care delivery systems as well as self-directed services. States may use a statistically valid random sampling of individuals to report the data. Effective dates: States must come into compliance with the HCBS waiting list reporting requirement and the reporting on wait times and authorized service hours for the selected services by July 9, 2027 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date.

Finally, the rule amends existing 1915(c) HCBS waiver reporting expectations to avoid duplicate or conflicting reporting requirements. Under this requirement, annually and in the form, manner, and time specified by CMS, states must provide information on the waiver’s impact on the type, amount, and costs of services provided under the state plan. Effective dates: July 9, 2027 for FFS, and in the case of managed care, for contract rating periods beginning on or after that date.  

Provider Payment

Federal law entitles Medicaid beneficiaries to medical assistance, defined under section 1905(a) of the Social Security Act (the Act) as, “payment of part or all of the cost of the following care and services or the care and services themselves, or both”. Section 1902(a)(30)(A) of the Act requires that Medicaid state plans ‘‘assure that payments are consistent with efficiency, economy, and quality of care and are sufficient to enlist enough providers so that care and services are available under the plan at least to the extent that such care and services are available to the general population in the geographic area’’ (emphasis added). Fulfilling these obligations necessitates CMS to require sufficient provider payments to ensure beneficiaries have access to care. These standards are important to assure that people with low-incomes who are enrolled in Medicaid can access care and services they need to get and stay healthy.

The Access and Managed Care Rules include various provisions aimed at improving payment rate transparency, such as requiring states to post FFS payment rate schedules, compare Medicaid FFS payment rates to Medicare rates, disclose HCBS payment rates to allow for comparisons over time and between states, and report aggregate provider payment rates under managed care compared to what the state would have paid under FFS. Taken together, these provisions will result in significantly more publicly available payment rate data that can inform future payment rate changes.

---

Fee-for-Service Rules in a Managed Care State

As noted, most Medicaid beneficiaries in most states are enrolled in managed care. However, all states have Medicaid FFS fee schedule payment rates in effect and are therefore subject to the rules described below under § 447.203(b), regardless of the quantity of services covered or delivered or number of beneficiaries enrolled in managed care. Even states that generally enroll all beneficiaries into managed care plans pay for some services on a FFS basis that are not covered under the plan contract. For example, during coverage transition periods, such as when an individual is Medicaid eligible but not yet enrolled in a managed care plan, or during periods of retroactive coverage.

---

FFS Payment Rate Transparency (§ 447.203(b)(1))

[Medicaid; FFS]

Under access regulations finalized in 2015, states are required to develop and submit to CMS an Access Monitoring Review Plan (AMRP) for certain Medicaid services. The AMRP must separately analyze access to: primary care services (including those provided by a physician, FQHC, clinic, or dental care), physician specialist services (for example, cardiology, urology, radiology), behavioral health services (including mental health and substance use disorder), pre- and post-natal obstetric services including labor and delivery, and home health services, along with three types of “additional services,” those subject to a rate reduction, those for which the state or CMS has received a lot of complaints, and any additional services selected by the state.

The Access Rule rescinds the AMRP requirements and implements a new regulatory framework for access monitoring including improved rate transparency and analysis. Under the new rule, states must post Medicaid FFS payment rates on a publicly available website by July 1, 2026. Medicaid FFS payment rates must be organized in such a way that a member of the public can readily determine the amount Medicaid would pay for a given service. Rates must be provided separately for adults and children if they vary by population. The preamble to the rule emphasizes that the posting requirement is limited to fee schedule payment rates that are known in advance of a provider delivering a service.[19] Payments made by statutory formula (e.g., prospective payment rates made to federally qualified health centers (FQHCs), rural health clinics (RHCs), and certified community behavioral health clinics (CCBHCs)) and cost-based payments are excluded. Bundled payments are included in the transparency requirements, but states must provide a breakdown of the constituent parts only if each component is based on a fee schedule payment rate.

CMS issued a companion guide with an example of these rate transparency requirements and how to handle payment bundles shortly after issuing the final rule.[20] Effective date: July 1, 2026, though states are no longer required to comply with AMRP requirements as of July 9, 2024.

FFS Payment Rate Analysis and Disclosure (§ 447.203(b)(2)-(5))

[Medicaid; FFS]

In addition to requiring states to post FFS payment fee schedules, the Access Rule requires states to compare base Medicaid FFS rates to Medicare rates for primary care, OB/GYN services, and outpatient mental health and substance use disorder services. Rates must be compared at the code level and must include any beneficiary copayment amounts but exclude supplemental payments. If the rates vary based on provider type, adult versus pediatric patients, or geographic location, separate reporting is required. States must post the Medicaid rate, the Medicare rate, the Medicaid rate as a percentage of the Medicare rate, the number of Medicaid-paid claims and the number of people enrolled in Medicaid who received the service within the calendar year. CMS posts the Medicare rates needed for this analysis annually in the Medicare Physician Fee Schedule. The companion guide noted above details these requirements and outlines how to conduct the payment analysis.[21] Effective date: July 1, 2026 (comparing 2025 rates) and every two years thereafter.

For certain HCBS services (personal care, home health aide, homemaker, and habilitation services), states are required to disclose the Medicaid payment amount for 2025 by July 1, 2026 and every two years thereafter. States are required to disclose the Medicaid payment amount expressed as an average hourly rate regardless of whether the state actually pays for such services on an hourly, daily, or other basis, in order to allow for comparison over time and between states. Like the payment analysis, if the rates vary based on provider type, adult versus pediatric patients, or geographic location, the rates must be separately disclosed. Unique to the HCBS payment rate disclosure, states must identify whether the payment rate includes facility-related costs. Effective date: July 1, 2026.

HCBS Payment Transparency and Adequacy (§§ 441.311(e) and 441.302(k)(3))

[Medicaid; FFS and managed care]

HCBS payment rates must be adequate to ensure a sufficient direct care workforce to meet the growing demand for high-quality HCBS care, and yet, HCBS rate increases have not always resulted in corresponding higher wages for HCBS direct care workers. Under § 441.311(e) of the Access Rule, in both FFS and managed care delivery systems, states will be required to report annually on the share of Medicaid payments for homemaker services, home health aide services, personal care, and habilitation services that goes to direct care worker compensation, or the “compensation percentage.” The state must report separately for each service, and within each service, must separately report services that are self-directed and services that are delivered in a provider-operated physical location for which facility costs are included in the payment rate. The rule does not require these reports to be posted publicly. Effective date: The reporting requirement is effective as of July 9, 2028 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date.

In addition to this broad reporting requirement, the Access Rule requires that states meet a minimum performance payment adequacy requirement for some direct care workers under § 441.302(k)(3). Specifically, states will be required to provide assurances to CMS that each home care provider spends 80 percent of total payments on compensation for direct care workers who furnish homemaker, home health aide, or personal care services (this “80 percent rule” does not apply to habilitation services which are subject to the reporting requirement above). States may set a lower threshold for “small” providers, as defined by the state, as long as the criteria for defining “small” and the performance percentage are reasonable, objective, and developed through a transparent process. States may also develop a hardship exemption for providers of any size that are facing “extraordinary circumstances that prevent their compliance” with the 80 percent rule. States that take advantage of these flexibilities must report to CMS annually on the criteria developed, the percentage of providers impacted, and the plan for improved performance in the future. Effective date: The HCBS payment adequacy provision is effective July 9, 2030 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date.

FFS Rate Reductions (§ 447.203(c))

[Medicaid; FFS]

Under current regulations, as part of the CMS approval process for rate reductions or restructuring in FFS, states must analyze access to services subject to the rate reduction, consider the data collected through the AMRP, and undertake a public process that solicits input on the potential impact of the proposed changes. As noted above, the Access Rule eliminates the AMRP process and implements new payment transparency and analysis requirements. For rate reductions, the Access Rule establishes a two-tiered approach: CMS will use a lower level of review for rate reduction/restructuring state plan amendments (SPAs) that satisfy certain criteria and a higher level of review with enhanced analysis requirements for those SPAs that do not meet the criteria.

To satisfy tier one, states must provide CMS with written assurance and relevant supporting documentation to establish that: (1) services affected by the proposed rate reduction or restructuring would be paid at or above 80 percent of the most recently published Medicare rates for the same or comparable aggregate set of Medicare-covered services; (2) the proposed rate reductions or restructurings would result in no more than a four percent reduction in aggregate FFS expenditures for each benefit category within a single state fiscal year; and (3) the public processes set out in §§ 447.203(c)(4) and 447.204 yielded no significant access concerns, or if such process did yield concerns, the state can reasonably respond to or mitigate them. The state must also describe the procedures for monitoring continued compliance with section 1902(a)(30)(A) of the Act.

A SPA that proposes to reduce or restructure payment rates and fails to meet the criteria for tier one is subject to additional review. To satisfy tier two, in addition to providing the information above, states must summarize the payment rate change; compare the aggregate payment rates before/after the proposed change to Medicare, and other payers if feasible; describe trends in the number of actively participating providers, beneficiaries served, and services delivered in each affected benefit category over the past three years; and summarize the state’s response to any access to care concerns received from beneficiaries, providers, and other interested parties regarding the affected services.

States must have ongoing mechanisms for beneficiary and provider input on access to care, but neither the state nor CMS are required to post the SPA or supporting documentation for tier one or tier two. CMS may disapprove SPAs if states fail to comply with these analysis requirements. Effective date: SPAs submitted on or after July 9, 2024.

Managed Care Payment Rate Analyses and Reporting (§§ 438.207(b) and (d), 457.1230(b))

[Medicaid and CHIP; managed care]

Current regulations require that each MCO, prepaid inpatient health plan (PIHP), and prepaid ambulatory health plan (PAHP) provide to the state Medicaid agency documentation that demonstrates that it maintains a network of providers that is sufficient in number, mix, and geographic distribution to meet the needs of the anticipated number of enrollees in the service area. The state agency, in turn, is required to submit to CMS an analysis that supports the assurance of the adequacy of the network of each MCO, along with supporting documentation.

The Managed Care Rule requires that each MCO, PIHP and PAHP submit a “payment analysis” to the state Medicaid agency that compares the total amount paid by the plan for evaluation and management (E&M) codes for primary care, OB/GYN, mental health, and substance use disorder services during the prior rating period with the total that would have been paid by the plan if the plan had used published Medicare payment rates for those services. These rules echo the FFS payment analysis requirements, but the managed care payment analyses will be conducted on an aggregate basis. For certain long term care services that Medicare does not cover, such as homemaker, home health aide, personal care, and habilitation services, the analysis must provide the total amount paid and the percentage that results from dividing the total amount paid by the amount the state’s Medicaid FFS program would have paid for the same services. If the percentages differ between adult and pediatric services, they must be reported separately.

The state agency, in turn, is required to include these payment analyses in the annual analysis it must submit to CMS and to post its analysis on the state agency’s website within 30 calendar days of submission. These requirements apply to separate CHIP programs by cross reference at § 457.1230(b), except that states must submit the Medicaid analyses to CMS in advance of CMS’ review and approval of the Medicaid managed care contract. Effective dates: These payment rate analyses requirements will take effect for contract rating periods beginning on or after July 9, 2026, but most states must post an assurance of compliance with adequate capacity and services for contract rating periods beginning on or after July 9, 2025. 

Managed Care Payment

The Managed Care Rule includes several technical, but important, revisions to managed care payment policies. The primary overarching theme to these provisions is building transparency and oversight to managed care payments to better understand how capitation dollars are being spent and help ensure managed care delivers value. A second and important theme is building targeted flexibilities to allow payment to improve access to care, including access to a broader range of Medicaid services.

State Directed Payments (§§ 438.6, 438.7, 430.3)

[Medicaid; managed care]

In Medicaid managed care delivery systems, the state Medicaid agency is generally prohibited from directing how MCOs, PIHPs, and PAHPs, pay their network providers. However, in 2016 CMS formally established a regulatory exception allowing states some limited power over how managed care plans pay providers, known as “State Directed Payments” (SDPs). Under an SDP, for example, states have been allowed to require managed care plans to use a minimum or maximum fee schedule, set a uniform payment increase for selected providers, participate in multi-payer models, or use a value-based purchasing method. States can use this authority to improve rates for targeted providers (i.e., for example, when access problems are identified) or to more generally support health care infrastructure. Most SDP funding has gone to hospitals, but states have also used SDPs to support access to mental health, substance use disorder treatment, and dental care.[22] Depending on the design of the SDP arrangement, it may have a streamlined or more complex approval process. Under the Managed Care Rule, states have a new option for streamlined SDPs: they can require managed care plans to pay providers using Medicare rates.

In response to the rapid growth in SDP spending across states, the new rule also increases oversight over SDP spending. Starting September 2024, states must include SDP spending data in medical loss ratio (MLR) reporting. In addition, after CMS develops reporting instructions, states will have to report provider-specific data annually through the Transformed Medicaid Statistical Information System (T-MSIS), allowing CMS to track how much money is flowing to which providers. States will also be required to submit evaluation reports for most types of SDPs when they amount to more than 1.5 percent of managed care program costs. States will be required to publicly post the evaluations, and CMS has committed to posting them as well. The rule will allow some managed care SDP payments to go as high as the Average Commercial Rate (ACR), which is often well above Medicaid and Medicare rates. This creates misalignment with FFS supplemental payments, which are generally capped at Medicare payment levels. In the rule, CMS also opted not to set caps for total SDP spending.

Finally, in the preamble to the rule, CMS clearly reiterates that provider taxes, a critical source of state funding for SDPs, remain a permissible tool for financing the state share of SDPs.[23] However, the rule will require states to collect compliance attestations from taxed providers, which could make it harder for states to implement provider taxes. CMS issued an Informational Bulletin parallel to the new regulations indicating it will be working collaboratively with states between now and 2028 to help them come into compliance with the new provider tax requirements.[24] Effective dates: Streamlined option for SDP using minimum Medicare fee schedule, July 9, 2024; SDP reporting in MLR reports, September 9, 2024; SDP reporting in T-MSIS, no later than the date specified in the T–MSIS reporting instructions released by CMS; SDP evaluation reports, contract rating periods beginning on or after July 9, 2027; SDP caps as high as ACR, contract rating periods beginning on or after July 9, 2024; provider tax compliance attestations, contract rating periods beginning on or after January 1, 2028. 

In Lieu of Services (§§ 438.2, 438.3, 438.7, 438.10, 438.16, 438.66, 457.1201, 457.1207)

[Medicaid and CHIP; managed care]

Medicaid managed care plans have long covered “In Lieu of Services” (ILOS), which are services that are provided in substitution of traditional Medicaid state plan services. For example, an MCO might provide a community-based depression screening in lieu of an office visit screening. ILOS are important because, unlike other non-traditional services a managed care plan may choose to provide, ILOS are factored into rate setting, thus giving managed care plans a stronger incentive to provide the services. CMS formally defined ILOS for the first time in 2016 regulations. Recently, interest has grown in ILOS as a mechanism to cover services to meet health-related social needs.

Historically, the use of ILOS was constrained to substitution services that were direct and immediate substitutions. CMS’s new rule modifies the definition of ILOS to explicitly include services that are “an immediate or longer-term substitute for a covered service or setting” or that “can be expected to reduce or prevent the future need to utilize the covered service or setting.”[25] This broader definition will allow states to make investments in services that address prevention or health-related social needs that go beyond the traditional state plan services. For example, a state might cover medically-tailored meals for individuals with diabetes to reduce (or “substitute” for) emergency room or hospital use.

The new rule also codifies protections for individuals enrolled in Medicaid accessing ILOS. These include requirements that:

• Individuals accessing ILOS have all rights and protections that apply to traditional Medicaid managed care services (including appeals rights);
• Individuals retain the right to receive state plan services, regardless of being offered, using, or previously using ILOS;
• ILOS may not be used to discourage access to state plan services;
• Plans must describe these protections in enrollee handbooks; and
• States must include these requirements in plan contracts.

Finally, the rule also increases oversight and control over ILOS spending. States will be required to document the details and eligibility criteria for the ILOS they are providing and ensure they have clearly identifiable codes in encounter data. In addition, states will be required to submit a series of reports summarizing their projected and actual spending on ILOS, including one based on actual claims and encounter data. States will have documentation and evaluation reporting requirements when projections or spending exceeds 1.5 percent of capitation and they will be subject to a five percent cap on total ILOS spending. The new ILOS requirements are generally applicable to separate CHIP by cross references at §§ 457.1201 and 457.1207, with some exceptions (e.g., excluding from CHIP references that are inapplicable such as actuarial certification and SDPs). Effective dates: Expanded definition of ILOS and enrollee protections, contract rating periods beginning on or after July 9, 2024; oversight requirements, contract rating periods beginning on or after September 9, 2024.

Medical Loss Ratio Standards (§§ 438.8, 438.3, 457.1203)

[Medicaid and CHIP; managed care]

An MLR is a measure of how much of the capitation payments to a plan goes toward providing Medicaid services to enrollees and improving quality, as opposed to administration and profit. Current Medicaid regulations require plans to submit annual MLR reports to states, and states to in turn submit an annual “summary description” of the MLR reports to CMS. The rule clarifies that the summary description must be provided for each plan under contract with the state and also requires MLR reporting to factor in SDP spending. In addition, the rule clarifies how provider incentive arrangements and bonus payments are counted in the MLR calculation. The updates to the MLR requirements apply to separate CHIP by existing cross reference at § 457.1203, though the final rule makes some technical changes to clarify that the SDP-related provisions do not apply to separate CHIP. Effective dates: Plan level MLR reporting and inclusion of SDPs in MLR reporting, September 9, 2024; provider incentive arrangement policies, contract rating periods beginning on or after July 9, 2025.

Medicaid Quality Systems and Reporting

 The Managed Care Rule makes significant improvements to managed care quality requirements, including boosting transparency and reducing reporting lag times. When fully enacted, these changes will transition states from reporting a single overall quality rating for a managed care plan to rating all mandatory measures individually for each plan. Apart from eliminating primary care case management (PCCM) entities from inclusion with other types of MCOs, the rule adopts the provisions of the proposed rule[26] with minor changes for organizational clarity. The rule also sets forth a formal process for the HCBS quality measure development and requires states to use and report on the HCBS Quality Measure Set.  

Managed Care State Quality Strategy (§§ 438.340, 457.1240(d))

[Medicaid and CHIP; managed care]

The managed care state quality strategy is a foundational tool for states to set goals and objectives relating to the quality of care and access for managed care programs. Under prior regulations, each state contracting with MCOs was required to implement a written quality strategy for assessing and improving the quality of health care services furnished by an MCO, PIHP, or PAHP. The new rules increase opportunities for interested parties (e.g., health care providers and consumer advocates) to provide input on the state’s managed care state quality strategy prior to CMS review. The strategy must be reviewed every three years or whenever significant changes occur within the state’s Medicaid program. States must post the full evaluation of the effectiveness and results of the triennial review on the state’s website. States are also required to submit the results of the review to CMS for input prior to adopting as final. These requirements apply to separate CHIP by cross reference at § 457.1240(d). Effective date: The removal of PCCM entities from EQR requirements, July 9, 2024; transparency and public comment rules, July 9, 2025.

External Quality Review (§§ 438.350, 438.354, 438.364, 457.1240, 457.1250)

[Medicaid and CHIP; managed care]

External quality review (EQR) is an ongoing requirement for states to contract with an approved external quality review organization (EQRO) to perform an annual review for each contracted managed care entity. External quality review must be conducted for specific mandatory activities including validation of performance measures and improvement projects, compliance with disenrollment and enrollment requirements, and evaluation of network adequacy, among other standards. States may also conduct certain optional EQR activities, including a new provision allowing states to evaluate quality strategies, SDPs, and ILOS that pertain to outcomes, quality, or access to health care services as an EQR activity. The rule applies to CHIP except for the provision relating to SDPs, which are not applicable to CHIP. Effective date: July 9, 2024.

The rule improves transparency by requiring EQR technical reports to include specific data from the mandatory network adequacy validation activity, as well as any outcomes data and results of quantitative assessments, such as the percentage of enrollees who participated in a performance improvement project (PIP) or patient satisfaction based on the outcomes of the PIP. It must include an assessment of health plans’ strengths and weaknesses for quality, timeliness, and access to care, as well as recommendations for improving the quality of health care services and how the state can target goals and objectives in the quality strategy to improve quality and access. Effective date: Beginning July 9, 2024, and annually thereafter, states must post the EQR technical report by April 30 and notify CMS within 14 days of its posting. No later than December 31, 2025, states are required to maintain at least five years of EQR technical reports on their website.

Medicaid Managed Care Quality Rating System (§§ 438.500-535, 457.1240(d))

[Medicaid and CHIP; managed care]

The Medicaid managed care quality rating system (QRS) is intended to hold states and plans accountable for the quality of care provided to Medicaid and CHIP enrollees; to arm enrollees with useful information about plans available to them; and to provide a tool for states to drive improvements in plan performance and the quality of care provided by their programs. However, it was limited to a single overall rating of each managed care plan, which lacks the level of granularity that individuals need to make an informed choice when selecting a plan that best meets their specific needs, based on their age, gender, location, and health status. The Managed Care Rule advances the QRS as a one-stop-shop where enrollees can access information about Medicaid and CHIP eligibility and managed care; compare plans based on quality and other factors key to plan selection, such as the plan’s drug formulary and provider network; and select a plan that meets their needs. It also requires that states use their beneficiary support systems to assist applicants and enrollees with using the QRS.

As part of its quality assessment and improvement strategy, states must adopt the QRS framework developed by CMS, but they have the option to use the CMS rating methodology or an alternative rating methodology that yields comparable results and is approved by CMS. The QRS must include all measures in the mandatory QRS measure set as described in the QRS technical resource manual, regardless of whether the state implements the model rating methodology or adopts a CMS-approved alternative rating methodology. States must report quality ratings for each mandatory quality measure at the plan level for each managed care program, a significant improvement over the current requirement for a single quality rating for each plan.

At least every other year, CMS will engage the states and other interested parties (state officials, measure experts, health plans, beneficiary advocates, tribal organizations, health plan associations and EQROs) and provide public notice and opportunity to comment on modifications to the mandatory measure set. Mandatory measures must meet at least five of six criteria including if the measure: (1) is meaningful and useful for beneficiaries or their caregivers in choosing a managed care plan; (2) aligns with the mandatory measure set and other CMS quality measurement and rating initiatives; (3) assesses health plan performance in at least one of these specific areas: customer experience, access to services, health outcomes, quality of care, health plan administration, and health equity; (4) presents an opportunity for MCOs to influence their performance on the measure; (5) is feasible for states and plans to report without undue burden; and (6) demonstrates scientific acceptability by producing consistent and credible results.

CMS may make non-substantive changes such as updates to clinical codes or narrowing the denominator or population served as needed. For substantive changes, the rule calls for a public notice and comment period. A measure may be removed if the external measure steward retires or stops maintaining a mandatory measure;[27] there are changes in clinical guidelines associated with the measure; or there is low statistical reliability in the measure. CMS will update guidance to states on mandatory measures in the annual technical resource manual. Effective date: States must implement their managed care quality rating system by December 31, 2028, and thereafter, will have at least two calendar years to implement changes described in the annual technical resource manual. 

QRS Website Display (§§ 438.520, 457.1240(d))

[Medicaid and CHIP; managed care]

As a second phase of the quality rating system, the rule establishes requirements for a robust, interactive website display, which must comply with accessibility standards and was informed by intensive consultation with prospective users and iterative testing of a QRS website prototype. The display components must include information to help navigate and understand the content of the QRS website, including a statement of the purpose of the QRS, how to use the information to select a plan, how to access the beneficiary support system, and how personal information will be used.

The display must allow beneficiaries to identify MCOs available to them that align with their coverage needs and preferences. This includes identifying all managed care programs and plans for which a user may be eligible based on their age, geographic location, and dually eligible status (if applicable), as well as other demographic data. Additionally, it must include a description of the drug coverage for each managed care plan, including specific formulary information, as well as provider directory information or other provider information specified by CMS. Last, but not least, the display must include quality ratings, as well as any mandatory measures that must be stratified by dual eligibility status, race and ethnicity, and sex.

States will also be required to provide standardized information, specified by CMS, for each managed care plan that allows users to compare plans and programs including the plan name, internet hyperlink to the plan’s website and customer service telephone toll-free hot line. Standardized information will also include premium and cost-sharing; a summary of benefits and differences in benefits among available MCOs including other CMS specifications such as whether prior authorization is required; and other metrics of managed care performance such as the results of secret shopper surveys. Information on quality ratings included in the website display must promote beneficiary understanding and trust in the ratings, including the use of plain language. Additionally, the website must include information or hyperlinks to resources on how and where to apply for Medicaid and how to enroll in a Medicaid or CHIP plan. Effective date: The rule does not establish a firm data for the website display but indicates that it will be required no earlier than two years after the implementation date for the quality rating system (no earlier than December 31, 2030).

Technical Resource Manual (§§ 438.530, 457.1240(d))

[Medicaid and CHIP; managed care]

Beginning in calendar year 2027, CMS will publish a Medicaid managed care QRS technical resource manual annually. The manual will identify all Medicaid managed care QRS mandatory measures, any measures newly added or removed from the prior year, and the subset of measures that must be displayed and stratified by factors such as race and ethnicity, sex, age, rural/urban status, disability, and language. It must also provide guidance on the methodology used to calculate and issue quality ratings, as well as the measure steward’s technical specifications for mandatory measures. It must also include a discussion of the interested party feedback and recommendations, the rationale for not accepting or implementing specific recommendations, and final modifications and timelines for implementation.

Annual State QRS Report (§§ 438.535, 457.1240(d))

[Medicaid and CHIP; managed care]

Upon CMS request with no less than 90 days advance notice, and no more frequently than annually, the state must submit a Medicaid managed care QRS report in a form and manner determined by CMS. The report must include a list of mandatory measures identified in the most recent technical resource manual and the managed care program to which the measure applies. If a mandatory measure is not applicable, the state must provide a brief explanation as to why. The report must also include a list of any additional measures the state chooses to include in the QRS. In the report, the state must attest that all displayed ratings for mandatory measures were calculated and issued in compliance with these rules, as well as any deviations from the methodology. It must also include a summary of each alternative QRS rating methodology that has been approved by CMS and the effective date thereof. Effective date: July 9, 2024.

HCBS Quality Measure Set and Reporting (§§ 441.311(c), 441.312, 441.474(c), 441.585(d), 441.745(b)(1)(v))

[Medicaid; FFS and managed care]

In 2022, CMS released a set of nationally standardized quality measures for Medicaid-funded HCBS, however, use of the measure set was largely voluntary.[28] The rule sets forth a formal process for measure development and requires states to use and report on the HCBS Quality Measure Set in section 1915(c) waiver programs, and section 1915(i), (j), and (k) authorities.[29]

Beginning no later than December 31, 2026, the Secretary of HHS must identify and update the HCBS Quality Measure Set no more frequently than every other year. As part of the process for measure development, the Secretary of HHS is required to update the HCBS Quality Measures Set through a public process that allows for input from a variety of stakeholders such as states; providers, including direct care workers and groups; consumers; and national organizations and individuals with expertise in HCBS quality measurement. This includes identifying measures to add or remove, which measures are mandatory, potential phase-in periods for complex measures, the subset of measures that must be stratified by race, ethnicity, sex, age, rural/urban status, disability, language or other factors, and other requirements such as those related to technical requirements and procedures and reporting formats. It also includes identifying specific populations for which states must report the measures, including individuals enrolled in managed care or receiving services via FFS.

Under the reporting requirements, states must report every other year on all mandatory measures in the HCBS Quality Measure Set according to the format and schedule prescribed by the Secretary; this includes a potential phase in of mandatory state reporting for certain measures and populations as determined by the Secretary. The rule specifically requires a phased-in approach for measures for which the Secretary has specified that reporting should be stratified. Under the stratification phase-in, the Secretary must require stratification of 25 percent of the applicable measures by July 2028, 50 percent by July 2030, and 100 percent by July 2032. States may also report on the optional measures and some measures may be reported by HHS on behalf of the states. As part of state reporting requirements, states must also establish performance targets for each of the measures and describe the quality improvement strategies that the state will pursue to achieve the performance targets. The rule notes that CMS plans to provide States with technical assistance and subregulatory guidance to support implementation of the HCBS Quality Measure Set. Effective dates: The Secretary must identify and update the HCBS quality Measure Set by December 31, 2026. States must then comply with the HCBS Quality Measure Set reporting requirements by July 9, 2028 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date. Required stratification of applicable measures is phased-in over a number of years under the rule starting with 25 percent in 2028 going up to 100 percent by 2032.

Transparency and Monitoring of Medicaid Managed Care

The Managed Care Rule includes provisions to improve the public availability of information about the performance of MCOs in furnishing services to enrollees and, in doing so, improving the performance of state Medicaid agencies in monitoring the MCOs with which they contract. The timelines for implementation of these transparency requirements are extended,[30] but when fully implemented, these provisions will give enrollees, advocates, and the public better ability to hold MCOs and agencies accountable for the accessibility and quality of care.

Website Navigability (§§ 438.10(c)(3), 457.1207)

[Medicaid and CHIP; managed care]

Currently, state Medicaid agencies are required to maintain a website that provides specified content for enrollees and the public, either directly or through links to MCO websites. Although this requirement has been in effect since 2017, state compliance remains uneven. As CMS notes in the preamble to the rule, “There is variation in how ‘user-friendly’ States’ websites are, with some States making navigation on their website fairly easy and providing information and links that are readily available and presenting required information on one page. However, we have not found this to be the case for most States.”[31]

The rule requires that state Medicaid and CHIP agency websites place “clear and easy-to-understand labels” on documents and links and include all content on one webpage, either directly or by link to individual MCO websites. The rule further requires that state agencies verify the accurate function of their websites and the timeliness of the information presented, at least quarterly. Effective date: This requirement for easily navigable, accurate websites will take effect for contract rating periods beginning on or after July 9, 2026. 

Website Content (§§ 438.207(d)(2), 438.520, 438.602(g), 457.1240(d) and 457.1285)

[Medicaid and CHIP; managed care]

Under current regulations, state Medicaid agencies are required to post on their websites certain information about their managed care programs.  This information includes the risk contract with MCOs; enrollee handbooks, provider directories, and formularies; the state’s network adequacy standards; documentation that each MCO has adequate capacity to make its services accessible to enrollees; and the annual report by the state’s EQRO assessing the performance of each MCO.

The Managed Care Rule builds upon these transparency requirements by expanding the content required for the agency websites. Among the additional items that state agencies must post are: documentation of the availability of services from each MCO, (July 9, 2025); documentation of compliance with mental health/substance use disorder parity (July 9, 2026); state standards for appointment wait times (July 9, 2027); state directed payment (SDP) evaluation reports (July 9, 2026); and the results of secret shopper surveys (July 9, 2028). (Note each requirement is not applicable until the first rating period beginning on or after the effective dates shown in italics.) These requirements are generally applicable to separate CHIP programs by cross reference at § 457.1285, with some exceptions (e.g., excluding references to SDPs).

As of January 2027 in most states, the documentation of availability of services, above, will be required to include an analysis of the levels of payment by each MCO to its network providers in relation to Medicare payment rates for primary care, OB/GYN, mental health, and substance use disorder services.  If these percentages vary between services for children and services for adults then states must present them separately.

As explained in section V above, the rule also requires that state Medicaid agencies develop a Quality Rating System (QRS) that enables beneficiaries to make an informed choice about which MCO is best for them and their family.  The rule requires the agencies to “prominently display and make accessible to the public” on their improved websites the quality ratings and other information about each MCO. The QRS website display requirement also applies to separate CHIP by cross reference at § 457.1240(d).  The effective date for standing up this QRS website display is no earlier than December 31, 2030 (2 years after the implementation date for the QRS system).

Managed Care Annual Program Report (§438.66(e))

[Medicaid; managed care]

One of the items that state Medicaid agencies are currently required to post on their websites is their Managed Care Program Annual Report (MCPAR).  The purpose of these reports is to “allow CMS…to target efforts to assist states in improving their managed care programs while also ensuring compliance with managed care statutes and regulations, such as ensuring access to care.”  The reports, which are due to CMS within six months of the end of a contract year, include information on the availability and accessibility of services in each MCO, the quality and financial performance of each MCO, and any sanctions imposed.

Although states are required to post these reports on their websites, compliance is uneven.[32] The rule underscores this requirement by specifying that state agencies post their MCPARs within 30 days of submitting them to CMS.  This requirement took effect July 9, 2024.  The rule also adds to the list of required reporting elements in the MCPAR the results of enrollee experience surveys for each MCO and data on the ILOS, if any, that each MCO provides.  Effective date: This requirement will take effect for contract rating periods beginning on or after July 9, 2027.

Transparency and Monitoring of Home and Community Based Services

As noted in the Access Rule, reports, including those from the Office of Inspector General and Government Accountability Office, have found systemic issues with state HCBS health and safety policies and procedures highlighting serious risks associated with poor quality care and inadequate oversight of HCBS in Medicaid.[33] Appropriate and meaningful health and safety policies and procedures are particularly important for vulnerable populations such as children. Based on such reports and findings as well as stakeholder input, the rule establishes a number of new state incident management and grievance systems requirements.

HCBS Incident Management System (§§ 441.302(a)(6), 441.311(b), 441.464(e), 441.570(e), 441.745(a)(1)(v) and (b)(1)(i))

[Medicaid; FFS and managed care]

Under the Access Rule, states must provide an assurance that they operate and maintain an incident management system that identifies, reports, triages, investigates, resolves, tracks, and trends critical incidents for individuals receiving HCBS services under section 1915(c) waiver programs and 1915(i), (j), and (k) HCBS programs, including services delivered via managed care.[34] The rule also establishes a standard definition of what constitutes a “critical incident” to address the lack of a standardized federal definition for the type of events or instances that states should consider a critical incident and must be reported and considered for investigation. States must also require providers to report to the state (within state-established timeframes and procedures) any critical incidents that occur during the delivery of services specified in the individual’s person-centered plan, or result due to the failure to deliver such services.

In implementing the systems, states must enable electronic data collection, tracking, and trending and must use data including claims data and Medicaid Fraud and Control Unit data to identify critical incidents that are unreported by providers or occur as a result of the failure to deliver services and share information on the status and resolution of investigations with other entities in the state responsible for investigation of critical incidents. States must also separately investigate critical incidents if the investigative agency fails to report the resolution of an investigation within state-specified timeframes and meet reporting requirements related to their incident management system. As part of this reporting, the rule codified a 90 percent minimum performance standard for state demonstration of a number of critical incident requirements including that an investigation was initiated for no less than 90 percent of critical incidents.

With the rule, states must report annually to CMS on certain critical incidents, such as those for which an investigation was initiated, and on the results of an incident management system assessment every two years (unless CMS determines the system meets the requirements at which point the assessment must be done every five years). Effective dates: States must implement the incident management system requirements by July 9, 2027 in FFS, and in the case of managed care, for contract rating periods beginning on or after that date, however, states have until July 9, 2029 (or contract rating periods beginning on or after that date in managed care) to enable electronic critical incident data collection, tracking, and trending.

HCBS Grievance Systems (§§ 441.301(c)(7), 441.464(d)(5), 441.555(e), 441.745(a)(1)(iii))

[Medicaid; FFS]

Among other requirements, the ACA requires development and monitoring of a HCBS complaint system.[35] While existing regulations include fair hearing rights that apply across Medicaid, including for individuals receiving HCBS, current regulations do not provide a venue to raise concerns about issues that are not covered by the fair hearing process that individuals receiving HCBS services in the FFS delivery system may experience, such as failure of a provider to comply with the HCBS settings requirements. Accordingly, the rule establishes state grievance procedures for individuals receiving services under 1915(c), (i), (j), and K authorities through a FFS delivery system.[36]

Under the rule, states must establish procedures for individuals to file a grievance related to the state or provider’s compliance with the person-centered planning and service plan requirements and HCBS settings requirements. Grievances may be filed orally or in writing at any time and by individuals themselves or their authorized representatives – who are also allowed to represent them throughout the process. States must provide reasonable assistance to individuals in filing grievances, including help for individuals with disabilities or limited English proficiency. The rule includes a number of requirements related to state handling, recordkeeping, and accessibility related to the grievance process including that decisions on grievances must be made by individuals who were not involved in the initial decision and who have appropriate expertise. States must keep detailed records of all grievances, including the reason for the grievance, dates of review, and the resolution, and ensure no punitive or retaliatory actions are taken against individuals who file grievances.

Under the rule, grievances must be resolved as quickly as the individual’s health condition requires, but no later than 90 calendar days from when the grievance is received with notice of the resolution provided to them in an accessible format. The state is permitted to extend the timeline by up to 14 days if the individual requests the extension, or the state documents that there is need for additional information and how the delay is in the individuals’ best interest. Effective date: States are required to comply with the grievance system requirements by July 9, 2026.

Technical Changes for State HCBS Reporting Requirements (§§ 441.474(c), 441.580(i), 441.745(a)(1)(vii))

[Medicaid; FFS and managed care]

In accordance with ACA requirements for states to achieve a more consistent administration of policies and procedures across HCBS programs and to ensure appropriate state reporting of HCBS requirements included in the rule, the rule modifies various regulatory sections for HCBS authorities to clarify that references to section 1915(c) are instead references to section 1915(j), (k), and (i), where applicable. Effective dates: July 9, 2024.

HCBS Website Transparency (§§ 441.313, 441.486, 441.595, 441.750)

[Medicaid; FFS and managed care]

To ensure that information about the accessibility and quality of HCBS services is available to Medicaid applicants and beneficiaries, the Access Rule requires state Medicaid agencies to operate a consumer-friendly website that contains the results of the reports that states are required to submit to CMS.  More specifically, website must present the results of state reporting on (1) the state’s incident management system; (2) critical incidents; (3) reassessments for functional need; (4) results from the HCBS Quality Measures Set identified by CMS; (5) waiver waiting lists; (6) access to homemaker, home health aide, personal care, and habilitation services; and (7) adequacy of payment for those services.  In states that establish a separate payment adequacy standard for small employers or exempt providers from any requirement in cases of hardship, the website must also present the percentages of providers qualifying for one or both exemptions.

State agencies must verify the accurate function of the website and the timeliness of the information at least quarterly.  These website requirements apply to states providing HCBS services under sections 1915(i), 1915(j), and 1915(k) as well as under 1915(c). The rule also requires that CMS report on its website the results submitted by states; this will ensure that applicants and beneficiaries have a source of information if their state Medicaid agency does not post the required information.  Effective date: These website transparency requirements are effective for state agencies July 9, 2027, except that if a state includes HCBS services in its contracts with MCOs, for contract rating periods beginning on or after that date. The website transparency requirement for CMS is effective July 9, 2024.

---

The authors would like to thank Joan Alker, Catherine Hope, and Madeline McBride. The Georgetown University Center for Children and Families (CCF) is an independent, nonpartisan policy and research center founded in 2005 with a mission to expand and improve high-quality, affordable health coverage for America’s children and families. CCF is based at the McCourt School of Public Policy. Support for this report was provided by the Robert Wood Johnson Foundation. The views expressed here do not necessarily reflect the views of the Foundation.

Editor’s Note: An “Implementation Timeline” is available in the PDF version of this report.

---

Download the Full Report

Endnotes

[1] “March 2024 Medicaid & CHIP Enrollment Data Highlights,” Centers for Medicare and Medicaid Services, available at https://www.medicaid.gov/medicaid/program-information/medicaid-and-chip-enrollment-data/report-highlights/index.html.

[2] R. Rudowitz et al., “10 Things to Know About Medicaid” (San Francisco: KFF, June 2023), available at https://www.kff.org/medicaid/issue-brief/10-things-to-know-about-medicaid/.

[3] “Medicaid Program; Ensuring Access to Medicaid Services,” Federal Register 89: 40542-40874 (May 10, 2024).

[4] “Medicaid Program; Medicaid and Children’s Health Insurance Program (CHIP) Managed Care Access, Finance, and Quality,” Federal Register 89: 41002-41285 (May 10, 2024).

[5] There are 10 states without Managed Care: AL, AK, CT, ID, ME, MT, OK, SD, VT, WY. “Total Medicaid MCO Enrollment,” KFF, available at https://www.kff.org/other/state-indicator/total-medicaid-mco-enrollment/?currentTimeframe=0&sortModel=%7B%22colId%22:%22Location%22,%22sort%22:%22asc%22%7D.

[6] “The Patient Protection and Affordable Care Act,” Public Law 111-148, 124 Stat 119 § 2402 (2010), available at https://www.congress.gov/111/plaws/publ148/PLAW-111publ148.pdf.

[7] M. Ralls, “Using Medicaid Payment Strategies to Support Family Caregivers and Direct Care Workers,” (Hamilton, New Jersey: Center for Health Care Strategies, February 2022), available at https://www.chcs.org/using-medicaid-payment-strategies-to-support-family-caregivers-and-direct-care-workers/.

[8] The rule notes that while the advising and consulting requirements are limited to these services, states have the discretion to have the IPAG advise on additional services. In addition, states also retain the flexibility to have the group advise on provider payment rates in managed care delivery systems.

[9] Agency for Healthcare Research and Quality, “What is Patient Experience?” (Rockville, Maryland: Agency for Healthcare Research and Quality, July 2024), available at https://www.ahrq.gov/cahps/about-cahps/patient-experience/index.html.

[10] Currently, 34 states operate a separate CHIP program, either exclusively or in combination with enrolling CHIP children in Medicaid. Of these separate CHIP program states, 27 use MCOs to deliver covered services to CHIP children (the other seven use the FFS delivery system). A. Schneider et al., “An Introduction to Managed Care in CHIP” (Washington: Center for Children and Families, March 24, 2023), available at https://ccf.georgetown.edu/2023/03/24/an-introduction-to-managed-care-in-chip/.

[11] 89 Fed. Reg. 40567 (May 10, 2024).

[12] Supra note 6.

[13] E. Park et al., “Consolidated Appropriations Act, 20233:  Medicaid and CHIP Provisions Explained” (Washington: Center for Children and Families, January 5, 2023), available at https://ccf.georgetown.edu/2023/01/05/consolidated-appropriations-act-2023-medicaid-and-chip-provisions-explained/

[14] Note the SHO also provides guidance on provider directory requirements for FFS delivery systems.  D. Tsai, “SHO #24-003, RE: Consolidated Appropriations Act, 2023 Amendments to Provider Directory Requirements” (Baltimore: Centers for Medicare & Medicaid Services, July 16, 2024), available at https://www.medicaid.gov/federal-policy-guidance/downloads/sho24003.pdf.

[15] S. Corlette et al., “Access to Services in Medicaid and the Marketplaces:  Comparing Network Adequacy Rules” (Washington: Center on Health Insurance Reforms and Center for Children and Families, March 1, 2022), available at https://www.rwjf.org/en/insights/our-research/2022/03/assessing-federal-and-state-network-adequacy-standards-for-medicaid-and-the-marketplace.html.

[16] M. Yiu and D. Machledt, “Secret Shopper Surveys:  A Powerful Too. For Directly Testing Medicaid Managed Care Enrollees’ Access to Care” (Washington: National Health Law Program, April 24, 2024), available at:  https://healthlaw.org/secret-shopper-surveys-a-powerful-tool-for-directly-testing-medicaid-managed-care-enrollees-access-to-care/.

[17] A. Burns, M. Mohamed, and M. O’Mally Watts, “A Look at Waiting Lists for Medicaid Home- and Community-Based Services from 2016 to 2023” (San Francisco: KFF, November 29, 2023), available at https://www.kff.org/medicaid/issue-brief/a-look-at-waiting-lists-for-medicaid-home-and-community-based-services-from-2016-to-2023/.

[18] 89 Fed. Reg. 40643 (May 10, 2024).

[19] 89 Fed. Reg. 40692 (May 10, 2024).

[20] CMS, “Ensuring Access to Medicaid Services – A Guide for States to the Fee-For-Service Provisions of the Final Rule” (Baltimore: Centers for Medicare & Medicaid Services, July 2024), available at https://www.medicaid.gov/medicaid/access-care/downloads/ffs-prov-final-rule-guidance.pdf.

[21] Ibid.

[22] MACPAC, “Directed Payments in Medicaid Managed Care” (Washington: Medicaid and CHIP Payment and Access Commission, June 2023), available at https://www.macpac.gov/wp-content/uploads/2023/06/Directed-Payments-in-Medicaid-Managed-Care.pdf.

[23] 89 Fed. Reg. 41073 (May 10, 2024).

[24] D. Tsai, “Exercise of Enforcement Discretion until Calendar Year 2028 for Existing Health Care-Related Tax Programs with Hold Harmless Arrangements Involving the Redistribution of Medicaid Payments” (Baltimore: Centers for Medicare & Medicaid Services, April 22, 2024), available at https://www.medicaid.gov/federal-policy-guidance/downloads/cib042224.pdf.

[25] 42 C.F.R. 438.2 (2024).

[26] “Medicaid Program; Medicaid and Children’s Health Insurance Program (CHIP) Managed Care Access, Finance, and Quality,” Federal Register 88: 28092-28252 (May 3, 2023), available at https://www.federalregister.gov/documents/2023/05/03/2023-08961/medicaid-program-medicaid-and-childrens-health-insurance-program-chip-managed-care-access-finance.

[27] A measure steward is an individual or organization that owns a measure and is responsible for maintaining the measure. Measure stewards may also be measure developers. Measure stewards are also the ongoing point of contact for people interested in a given measure e.g., medical specialty society or federal health agency. “Measure steward,” Electronic Clinical Quality Improvement (eCQI) Resource Center, available at https://ecqi.healthit.gov/glossary/measure-steward.

[28] D. Tsai, “SMD# 22-003, RE: Home and Community-Based Services Quality Measure Set,” (Baltimore: Centers for Medicare & Medicaid Services, July 21, 2022), available at https://www.medicaid.gov/federal-policy-guidance/downloads/smd22003.pdf.

[29] The rule does not apply the HCBS reporting requirements to 1905(a) HCBS services.

[30] A. Schneider, “A Closer Look at Transparency in the Medicaid Managed Care Rule” (Washington: Center for Children and Families, May 17, 2024), Table 2, available at https://ccf.georgetown.edu/2024/05/17/a-closer-look-at-transparency-in-the-medicaid-managed-care-rule/.

[31] 89 Fed. Reg. 41038 (May 10, 2024).

[32] A. Schneider, “Transparency in Medicaid Managed Care:  The MCPAR Saga Continues” (Washington: Center for Children and Families, June 24, 2024), available at https://ccf.georgetown.edu/2024/06/24/transparency-in-medicaid-managed-care-the-mcpar-saga-continues/.

[33] HHS OIG, HHS ACL, and HHS OCR, “Joint Report: Ensuring Beneficiary Health and Safety in Group Homes Through State Implementation of Comprehensive Compliance Oversight” (Washington: U.S. Department of Health and Human Services Office of Inspector General, Administration for Community Living, and Office for Civil Rights, January 2018), available at https://oig.hhs.gov/reports-and-publications/featured-topics/group-homes/group-homes-joint-report.pdf; HHS OIG, “State Compliance with Requirements for Reporting and Monitoring Critical Incidents” (Washington: U.S. Department of Health and Human Services Office of Inspector General), available at https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000264.asp; and GAO, “Medicaid Assisted Living Services: Improved Federal Oversight of Beneficiary Health and Welfare is Needed” (Washington: U.S. Government Accountability Office, January 5, 2018), available at https://www.gao.gov/products/gao-18-179.

[34] The rule does not mandate inclusion of section 1905(a) services in state requirements for incident management systems, but acknowledges that many individuals, particularly those receiving mental health services, are served by section 1905(a) services, and encourages states to consider development of critical incident processes to address protections for individuals from harm or events that place a beneficiary at risk of harm.

[35] Supra note 6.

[36] This requirement to establish a grievance system does not apply to managed care delivery systems with the rule noting that the requirements are similar to those for managed care grievance requirements. The rule also does not mandate inclusion of section 1905(a) services in state grievance systems, but acknowledges that many individuals, particularly those receiving mental health services, are served by section 1905(a) services, and encourages states to consider development of a grievance process to address concerns.