The Social Security Act provides multiple authorities for states to operate Medicaid managed care programs with federal approval. Most comprehensive Medicaid managed care programs are authorized through a state plan amendment (SPA), a Section 1915(b) program waiver, or a Section 1115 research and demonstration waiver.
| Issue | Section 1932(a) state plan amendments (SPA) | Section 1915(b) program waivers | Section 1115 research and demonstration waivers |
| General authority | Exempts states from state plan requirements for statewideness, comparability, and freedom of choice.1 | Provides states with a time-limited waiver from state plan requirements for statewideness, comparability, and freedom of choice. May be used to provide additional services that are not provided to enrollees who are not covered by the waiver, as well as limit the number of service providers. |
Broad authority permitting all of the flexibility allowed under 1915(b) waivers as well as waiver of other federal Medicaid requirements contained in Section 1902 of the Social Security Act. The Secretary of the U.S. Department of Health and Human Services may also provide federal matching funds for services, activities, or costs not otherwise matchable. |
| Approval period | Indefinite | Initially approved for two years. | Initially approved for five years, although the U.S. Department of Health and Human Services may approve shorter or longer periods. |
| Populations states may require to enroll | All state plan populations except certain children with special needs, Medicare beneficiaries, and American Indians. | All state plan populations. | All state plan populations, as well as any individuals not otherwise eligible for Medicaid (authorized through costs not otherwise matchable). |
| State application requirements | Completion of mandatory Centers for Medicare and Medicaid Services (CMS) state plan preprint. | Completion of CMS application template. | No CMS standard preprint form or template available, but must submit proposal describing design features of program (e.g., populations covered, design of Medicaid managed care program). |
| Federal budget requirements | No required budget or cost analysis. | Demonstrate cost effectiveness and efficiency of program (actual expenditures cannot exceed projected expenditures for approval period). | Demonstrate budget neutrality (federal expenditures cannot be greater during the approval period with the waiver than without the waiver). |
| CMS review time frame | Approved within 90 days of CMS receipt unless written disapproval or request for additional information. If additional information requested, 90-day period begins again on day CMS receives additional information. | Same as SPA time frame. | No required time frame for CMS review or approval, but CMS will not make a final decision on a demonstration until at least 45 days after submission. |
| Renewal period | No renewal needed. | Customarily up to two years; CMS has discretion to approve for five years if the waiver covers dually eligible enrollees. | Customarily up to three years; CMS has the discretion to approve for five years if the waiver covers dually eligible enrollees. |
| Program documentation | Contained within overall CMS state plan preprint. | Contained within CMS application template. | Special terms and conditions negotiated between CMS and states and documented. |
| Monitoring and evaluation | CMS monitors implementation of SPA to ensure requirements are met; state conducts separate evaluation of managed care entities. | Same as SPA. | CMS monitors implementation of waiver to ensure requirements are met; requires periodic evaluation of the project (often conducted by the state). |
1Statewideness refers to a requirement that the managed care program must be operational statewide. Comparability refers to a requirement that benefits for managed care enrollees must be equivalent to fee-for-service benefits. Freedom of choice refers to enrollees’ ability to receive services from any qualified provider; waiving this requirement requires enrollment in a managed care program and limits choice of providers to those in the health plan’s network.
Additional Medicaid Managed Care Activities
The Social Security Act also allows states to operate other forms of Medicaid managed care in addition to comprehensive Medicaid managed care through a number of other statutory provisions. The table below highlights key features of these additional managed care models and provides examples of how states have used various authorities to implement alternatives to fee for service.
| Program type | Program description | State examples |
| Program of All-Inclusive Care for the Elderly (PACE) | Provides prepaid, capitated comprehensive medical and social services in an adult day health center, supplemented by in-home and referral services according to a participant’s needs. To qualify, individuals must be 55 years of age or older, meet a nursing home level of care, and live in a PACE organization service area. | Thirty states operate PACE programs that enroll 31,910 individuals as of July 1, 2014. |
| Section 1945 health homes | Coordinates care for Medicaid beneficiaries who have chronic conditions. | Four states combine 1945 authority with a managed care authority such as 1915(a), 1932(a), or 1915(b) to provide health home services as part of a managed care program. |
| Section 1902(a)(70) non-emergency transportation (NEMT) program | Establishes NEMT brokerage programs without regard to the statutory requirements for comparability, geographic region served, and freedom of choice. | Eleven states use this state plan authority to provide NEMT services through a centralized vendor. |
| Section 1915(a) waiver | Enters into a voluntary contract with an entity to provide state plan services. Enrollment is voluntary. | A small number of states use this authority to operate comprehensive and specialty (e.g., behavioral health) managed care programs on a voluntary basis. |
| Section 1915(a)/(1915(c) combined waiver | Provides long-term services and supports (LTSS) in home and community settings rather than institutional settings and to provide LTSS and state plan services through managed care on a voluntary basis. | One of three models that uses concurrent authorities to allow states to provide home and community-based services to elderly or disabled Medicaid populations through their managed care programs. |
| Section 1915(b)/(1915(c) combined waiver | Provides LTSS in home and community settings rather than institutional settings and provides LTSS and state plan services through managed care on a voluntary basis. | One of three models that uses concurrent authorities allow states to provide home and community-based services to elderly or disabled Medicaid populations through managed care. Some states also use combined 1915(b)/(c) waivers to implement limited-benefit plans for specific services, such as prepaid inpatient health plans for behavioral health services. To implement concurrent 1915(b)/(c) waivers, states must meet all federal requirements associated with each type of waiver, such as cost neutrality in the 1915(c) and cost effectiveness in the 1915(b) waiver. |
| Section 1932(a)/1915(c) combined waiver | Provides LTSS in home and community settings rather than institutional settings and provides LTSS and state plan services through managed care on a mandatory basis for certain populations. | One of three models that uses concurrent authorities allow states to provide home and community-based services to elderly or disabled Medicaid populations through managed care. Limited to those populations that can be mandatorily enrolled under Section 1932(a) state plan authority. |
| Section 1937 benchmark benefits state plan amendment | Provides alternative benefits tailored to meet the needs of certain Medicaid population groups, target residents in certain areas of the state, or provide services through specific delivery systems instead of following the traditional Medicaid benefit plan. | This authority is often used in conjunction with Medicaid managed care to define the benefit package that will be offered through managed care plans. States can offer an enhanced benefit package to a targeted group through a specialized managed care plan or offer an alternative benefit package through a comprehensive managed care program. |
Source: Centers for Medicare & Medicaid Services (CMS), 2014, Enrollment data by program and population.
Comprehensive Risk-based Contract Requirements
Federal rules at 42 CFR 438 require state contracts with risk-based managed care organizations (MCO) to incorporate specific provisions. The Centers for Medicare & Medicaid Services (CMS) must review and approve all MCO contracts on an annual basis or when changes are made. This table summarizes the provisions that must be included in a contract between a state and a Medicaid MCO or that the contract must otherwise comply with.
| Provision | Contract requirement |
| Section 438.3 Standard contract requirements | |
| (a) CMS review | CMS must review and approve all MCO contracts, including those risk and nonrisk contracts that, on the basis of their value, are not subject to the prior approval requirement in Section 438.806. |
| (b) Entities eligible for comprehensive risk contracts | A state may enter into a comprehensive risk contract only with certain entities including an MCO, Community, Migrant, and Appalachian Health Centers, certain HIOs, and certain types of organizations identified in the Social Security Act. |
| (c) Payment | The final capitation rate for each MCO must be specifically identified in the applicable contract submitted for CMS review and approval. The final capitation rates must be based only upon services covered under the state plan and additional services deemed by the state to be necessary to comply with the parity standards from the Mental Health Parity and Addiction Equity Act), and represent a payment amount that is adequate and efficient. Capitation payments may only be made for Medicaid eligible enrollees. |
| (d) Enrollment discrimination prohibited | Enrollment is voluntary unless CMS has authorized mandatory enrollment. MCOs must accept enrollees in the order in which they enroll and may not discriminate against individual on the basis of health status or any other protected status. |
| (e) Services that may be covered by an MCO | MCOs may cover services in addition to those covered under the state plan although the cost of these services cannot be included when determining the payment rates, under certain circumstances. |
| (f) Compliance with applicable laws and conflict of interest safeguards | All state contracts with MCOs must comply with all applicable Federal and state laws and regulations including conflict of interest safeguards. |
| (g) Provider-preventable condition requirements | MCOs must identify provider-preventable conditions, cannot be paid for provider-preventable conditions, and must report provider-preventable conditions as required by the state. |
| (h) Inspection and audit of records and access to facilities | MCOs must provide the state, CMS, the U.S. Department of Health and Human Services Office of the Inspector General, the Comptroller General, and their designees with access for 10 years to inspect and audit any records or documents of the MCO or its subcontractors, and inspect the premises, physical facilities, and equipment where Medicaid-related activities or work is conducted. |
| (i) Physician incentive plans | MCOs must comply with rules regarding physician incentive plans. |
| (j) Advance directives | MCOs must maintain written policies and procedures for advance directives and provide information on these policies to adult enrollees. |
| (k) Subcontracts | Subcontracts must comply with all applicable requirements of 42 CFR 438. |
| (l) Choice of network provider | MCOs must allow each enrollee to choose his or her network provider to the extent possible and appropriate. |
| (m) Audited financial reports | MCOs must submit audited financial reports specific to the Medicaid contract on an annual basis. |
| (n) Parity in mental health and substance use disorder benefits | MCOs must provide for services to be delivered in compliance with the requirements of the Mental Health Parity and Addiction Equity Act (P.L. 110-343) implementing regulations. If any services are provided to MCO enrollees outside of the MCO contract the state must demonstrate to CMS how compliance with these requirements is met as part of the MCO contract review, even if the services are not part of the MCO contract. |
| (o) LTSS contract requirements | If the MCO provides long term services and supports (LTSS) as a covered benefit, services covered under the contract that could be authorized through a Section 1915(c) waiver or a Section 1915(i) or 1915(k) state plan amendment must be delivered in home and community based settings, consistent with federal rules. |
| (p) Special rules for certain HIOs | Contracts with HIOs that began operating on or after January 1, 1986, and that the statute does not explicitly exempt from requirements in section 1903(m) of the Social Security Act, are subject to all the requirements of this part that apply to MCOs and contracts with MCOs. |
| (q) and (r) apply to models other than MCOs | Not applicable. |
| (s) Requirements for MCOs, PIHPs, or PAHPs that provide covered outpatient drugs | MCOs that cover outpatient drugs must apply the same coverage standards as fee-for-service (FFS) Medicaid, report drug utilization data to the state no later than 45 days after the end of each quarter (excluding drugs subject to 340B pricing discounts as appropriate), and operate a drug utilization review program and a prior authorization program that meet the same standards as fee for service Medicaid. |
| (t) Requirements for MCOs, PIHPs, or PAHPs responsible for coordinating benefits for dually eligible individuals | If a state has a coordination of benefits agreement with Medicare for FFS and if the MCO contract includes responsibility for coordination of benefits for individuals dually eligible for Medicaid and Medicare, the MCO must also enter into a coordination of benefits agreement with Medicare and participate in the automated claims crossover process. |
| (u) Recordkeeping requirements | MCOs and their subcontractors must retain enrollee grievance and appeal records, base payment data, medical loss ratio (MLR) reports, and certain provider and service data, information, and documentation for a period of no less than 10 years. |
| Section 438.6 Special contract provisions related to payment. | |
| (b) Basic requirements | All applicable risk-sharing mechanisms, if used, must be described in the contract. Incentive and withhold arrangements must meet certain requirements. |
| (c) Delivery system and provider payment initiatives under MCO, PIHP, or PAHP contracts | Except under certain circumstances described in regulation, the state may not direct the MCO’s expenditures under the contract. The state may require the MCO, PIHP or PAHP to implement value based purchasing models for provider reimbursement; participate in a multi-payer or Medicaid-specific delivery system reform or performance improvement initiative; adopt a minimum or maximum fee schedule for network providers; or provide a uniform dollar or percentage increase for network providers that provide a particular service under the contract, so long as the MCO retains the ability to reasonably manage risk and has discretion in accomplishing the goals of the contract. States must obtain written approval for these arrangements that demonstrate compliance with regulatory requirements. |
| (d) Pass-through payments under MCO contracts | States may require MCOs to make pass-through payments, subject to certain requirements, to network providers that are hospitals, physicians, and nursing facilities under the contract. For contracts beginning on or after July 1, 2027, the state cannot require pass-through payments for hospitals under an MCO contract. For contracts beginning on or after July 1, 2022, the state cannot require pass-through payments for physicians or nursing facilities under an MCO contract. |
| (e) Payments to MCOs and PIHPs for enrollees that are a patient in an institution for mental diseases (IMD) | The state may make a monthly capitation payment to an MCO for an enrollee age21–64 receiving inpatient treatment in an IMD for a short term stay of no more than 15 days during the period of the monthly capitation payment when the treatment in an IMD meets requirements for in lieu of services. |
| Section 438.8 Medical loss ratio (MLR) standards | For contracts starting on or after July 1, 2017, each MCO must calculate and report a MLR in accordance with the regulations and submit required information to the state for each MLR reporting year to calculate and validate the accuracy of MLR reporting. |
| Section 438.10 Information requirements | MCOs must provide required information to all enrollees, including enrollee handbooks, provider directories (available in paper and electronic form), and the formulary. |
| Section 438.12 Provider discrimination prohibited | MCOs cannot discriminate in the selection, reimbursement, or indemnification of providers acting within the scope of their licensure or certification solely on the basis of that license or certification. |
| Section 438.14 Requirements that apply to MCO, PIHP, PAHP, PCCM, and PCCM entity contracts involving Indians, Indian health care providers (IHCPs), and Indian managed care entities (IMCEs) | All contracts between a state and an MCO that enrolls Indians must require the MCO to demonstrate that there are sufficient IHCPs participating in the provider network to ensure timely access to services available under the contract from such providers for Indian enrollees who are eligible to receive services and that IHCP services and providers be delivered and paid as required by regulation. |
| Section 438.56 Disenrollment: Requirements and limitations | Contracts must specify the reasons for which the MCO may request disenrollment of an enrollee, the reasons for which an MCO may not request disenrollment, and the reasons for which a beneficiary may request disenrollment (if otherwise limited). |
| Section 438.62 Continued services to enrollees | MCOs must implement a transition of care policy that meets state and federal requirements. State requirements must address transitions between FFS and MCO or from one MCO to another when an enrollee, in the absence of continued services, would suffer serious detriment to their health or be at risk of hospitalization or institutionalization. The transition of care policy must address access to services, referrals to appropriate providers, provision of historical utilization data, access to medical records, and other procedures necessary to ensure continued access to services to prevent serious detriment to the enrollee’s health or reduce the risk of hospitalization or institutionalization. |
| Section 438.68 Network adequacy standards | To the extent the state permits an exception to any of the provider-specific network standards developed under this section, the standard by which the exception will be evaluated and approved must be specified in the MCO contract. |
| Section 438.104 Marketing activities | MCOs may not distribute any marketing materials without first obtaining state approval; seek to influence enrollment in conjunction with the sale or offering of any private insurance, or directly or indirectly; or engage in door-to-door, telephone, email, texting, or other cold-call marketing activities. MCOs must distribute materials to the entire service area as indicated in the contract and provide information as required by 438.10. |
| Section 438.108 Cost sharing | Any cost sharing imposed on Medicaid enrollees must be in accordance with Medicaid rules. |
| Section 438.110 Member advisory committee | When LTSS is covered by an MCO, the MCO must establish and maintain a member advisory committee. |
| Section 438.206 Availability of services. | Each MCO must maintain and monitor a network of appropriate providers supported by written agreements and sufficient to provide adequate access to all services covered under the contract for all enrollees, including those with limited English proficiency or physical or mental disabilities. The network must also meet other requirements required by regulation, such as providing female enrollees with direct access to a women’s health specialist, providing or arranging for a second opinion at no cost, and arranging for out-of-network care if needed. The network must be sufficient to provide timely access to care, take into account access and cultural considerations, and accessibility considerations. |
| Section 438.207 Assurances of adequate capacity and services. | Each MCO must provide formal assurances to the state and provide supporting documentation that demonstrates that it has the capacity to serve the expected enrollment in its service area in accordance with the state’s standards for access to care. |
| Section 438.208 Coordination and continuity of care. | Each MCO must implement procedures to deliver care to and coordinate services for all enrollees, including ensuring that that each enrollee has an ongoing source of care appropriate to his or her needs and a person or entity formally designated as primarily responsible for coordinating the services the enrollee receives from the MCO and between settings of care such as services the enrollee receives from any other MCO or Medicaid delivery system, and community and social support providers. The MCO must attempt to conduct an initial screening of each enrollee’s needs within 90 days of the effective date of enrollment for all new enrollees. The MCO must require providers to maintain enrollee health records. |
| Section 438.210 Coverage and authorization of services. | The contract with each MCO must identify, define, and specify the amount, duration, and scope of each service that the MCO is required to offer and require that these services be furnished in an amount, duration, and scope that is no less than the amount, duration, and scope for the same services furnished to beneficiaries under FFS Medicaid and for enrollees under the age of 21 according to the rules for the EPSDT program. MCOs may place appropriate limits on a service and specify what constitutes medically necessary services. MCOs must have written policies and procedures for authorizations of services. Each MCO must notify the requesting provider, and give the enrollee written notice of any decision by the MCO to deny a service authorization request, or to authorize a service in an amount, duration, or scope that is less than requested within the timeframes required by federal rules. |
| Section 438.214 Provider selection. | Each MCO must have written policies and procedures for selection and retention of network providers that meet minimum federal requirements, including credentialing and recredentialing requirements and rules regarding nondiscrimination and excluded providers. |
| Section 438.224 Confidentiality. | Each MCO must comply with federal privacy requirements when dealing with medical records and any other health and enrollment information that identifies a particular enrollee. |
| Section 438.228 Grievance and appeal systems. | Each MCO must have a grievance and appeal system that meets federal requirements. |
| Section 438.230. Subcontractual relationships and delegation. | The federal requirements applying to Medicaid managed care organizations apply to any contract or written arrangement that an MCO has with any subcontractor. |
| Section 438.236 Practice guidelines. | Each MCO must adopt practice guidelines that are based on valid and reliable clinical evidence or a consensus of providers in the particular field, consider the needs of the MCO’s enrollees, are adopted in consultation with contracting health care professionals, and are reviewed and updated periodically as appropriate. The guidelines must be disseminated and applied when making utilization management decisions, as appropriate. |
| Section 438.242 Health information systems. | Each MCO must have a health information system that collects, analyzes, integrates, and reports data and can support all of the federal requirements relating to Medicaid managed care. The system must provide information on areas including, but not limited to, utilization, claims, grievances and appeals, and disenrollments for other than loss of Medicaid eligibility. MCO systems must work with state Medicaid information systems and collect and report data on enrollee and provider characteristics as specified by the state, and on all services furnished to enrollees through an encounter data system or other methods as may be specified by the state. |
| Section 438.330 Quality assessment and performance improvement program. | Each MCO must establish and implement an ongoing comprehensive quality assessment and performance improvement program for the services it furnishes to its enrollees. |
| Section 438.332 State review of the accreditation status of MCOs. | Each MCO must inform the state whether it has been accredited by a private independent accrediting entity. |
| Section 438.608 Program integrity requirements under the contract. | Each MCO must implement and maintain arrangements or procedures that are designed to detect and prevent fraud, waste, and abuse. This includes ensuring that all network providers are enrolled with the state as Medicaid providers consistent with the provider disclosure, screening and enrollment requirements. Each MCO must also provide written disclosure of any prohibited affiliation and information on ownership and control. |
| Section 438.726 State plan requirement. | Contracts with MCOs must provide that payments provided for under the contract will be denied for new enrollees when, and for so long as, payment for those enrollees is denied by CMS under Section 438.730(e). |
Notes: CMS is Centers for Medicare & Medicaid Services. HIO is health insurance organization. MCO is managed care organization. PAHP is prepaid ambulatory health plan. PCCM is primary care case management. PIHP is prepaid inpatient health plan.
Source: 42 CFR 438
State contracts with MCOs typically include many state- and program-specific provisions in addition to the minimum federally required provisions. These may address various operational and financial areas, including:
- Network development and maintenance
- Care management and coordination
- Customer service and member education
- Quality standards and reporting
- Data collection and reporting
- Monitoring and evaluation
- Provider payment
- Program integrity
- Corrective action
- Payment incentives and withholds
