Doctor in scrubs holding tablet in hospital corridor

Smart compliance for Medicaid

Helping state Medicaid agencies automate system compliance, while securing maximum federal support.

In brief
  • Systems that are noncompliant with federal regulations may be subject to corrective action and even a loss of federal funding.
  • States can benefit from new innovations in regulatory monitoring tools to help maintain this level of rigor and better safeguard their federal Medicaid funds.
  • States may use different tracking mechanisms for each of these steps and may also have different tracking mechanisms across different teams or program areas.

On May 24, 2023, the Centers for Medicare and Medicaid Services (CMS) issued a Center for Medicaid and CHIP Services (CMCS) Information Bulletin (CIB) that provided guidance regarding regulatory compliance requirements that states must meet to continue receiving a 75% federal match rate for ongoing operations of their Medicaid Enterprise System (MES). The bulletin emphasized CMS’ purview to periodically review and reapprove MES modules for smart compliance, as detailed in 42 CFR § 433.119. Systems that are noncompliant with federal regulations may be subject to corrective action and even a loss of federal funding. Considering that CMS spends $5 billion annually on state Medicaid technology, states that are found to be noncompliant with CMS requirements may be at risk of significant funding deficits. CMS has indicated that it does not expect to withdraw federal funding until after the COVID-19

Public Health Emergency (PHE) unwinding has been completed; however, CMS may begin assessing compliance before then, making the call to action for states immediate.


The key question facing states is how they will confirm that their MES is fully compliant with all existing federal regulations and applicable sub regulatory guidance. While states could manually review each individual regulation in the Code of Federal Regulations (CFR), refer to historic State Medicaid Director Letters (SMDLs) for additional guidance or even review the state’s own project documentation from when legacy regulatory changes were implemented, there are more efficient ways to confirm their compliance. Tools and technologies exist that can support states with this effort. Technology such as artificial intelligence (AI), machine learning, automation and data-driven dashboards can help states:

  • Ingest regulations, policies and other documents to identify rules
  • Automate rule mapping to responsible units or systems within the agency
  • Collect evidence of compliance and build a longitudinal repository
  • Test current MES functionality to assess compliance
  • Report compliance status in real time through user-based dashboards

While there is an immediate need for states to confirm their current compliance, CMS also plans to continue monitoring smart compliance on an ongoing basis. Now is the time for states to build a long-term, modern strategy for approaching risk and compliance to protect their federal funding. A modernized strategy includes leveraging tools that can increase the efficiency and accuracy of regulatory identification, implementation, reporting and continued compliance. This long-term approach can enable states to:


Medicaid is governed by a complex network of both state and federal regulations, which can be challenging for stakeholders to navigate. This includes navigation by the state agencies that administer the program, as agencies have to identify regulatory changes, interpret them, implement them and then manage ongoing compliance. Given the hundreds of Medicaid regulations that exist, this can be a daunting task.