Part 4 - Iowa Medicaid Enterprise

RFP MED-12-001 | Technical ProposalIowa Medicaid Enterprise System Service Procurement | MMIS and Core MMIS Operationsthe procurement agreement or subcontract. The contract management team researches the issue with theaccount manager and the subcontractor. This may involve communicating with the businessrepresentatives or the contract management group from the other party. The contract management teamfacilitates discussion between the organizations to resolve that issue. Issues that cannot be resolvedthrough such discussion will be handled according to a predefined contractual dispute resolution process.7.13 Regulatory ComplianceRFP Section 5.13Team Noridian’s new MMIS solution, eCAMS, is a proven and certified MMIS system that—in addition tomeeting the current State and Federal Regulatory Compliance—provides a platform to adapt to subsequentregulatory changes. eCAMS is proven and operational in the states of Washington and Michigan, and willmeet the State of Iowa and federal regulatory compliance for system service components.Team Noridian's proposed solution is based on the eCAMS platform that is fully aligned with theMedicaid Information Technology Architecture (MITA). eCAMS was recently certified by CMS in thestates of Washington and Michigan using the latest toolkit. eCAMS' core principles of modularity, openstandards, and especially its business-driven architecture, enables its alignment with the MITA direction.eCAMS is evolving to support adoption of the harmonized standards around health information exchange(HIE) as the Medicaid program becomes a key component of the CONNECT health care framework.With the realization that the MITA is continually evolving, Team Noridian provides a point-in-timeassessment of the proposed solution offering and its alignment with MITA. eCAMS is compliant with: 1)the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law 104-19, Title II,Sections 261-264; 2) the HIPAA Administrative and Simplification Provisions for Privacy (2002) andSecurity (2003), Code of Federal Regulations (CFR) 45, parts 160, 162, and 164); and 3) the HealthInformation Technology for Economic and Clinical Health (HITECH) Act of 2009 (enacted as part of theAmerican Recovery and Reinvestment Act of 2009). Team Noridian's processes ensure all systems andservices related to this procurement, including transactions, common identifiers, and privacy and securitystandards, continue to remain in compliance as stipulated in legislation or other regulatory requirements.7.13.1 Fully Compliant System Services ComponentsRFP Section 5.13, Requirement aTeam Noridian has extensive experience working within the HIPAA regulations related to transactions,code sets, identifiers, privacy, and security in similar MMIS implementations, including the WashingtonProviderOne and Michigan CHAMPS projects. This experience has provided Team Noridian with acomprehensive understanding of the issues and risks associated with implementing HIPAA. TeamNoridian has reviewed the RFP requirements and concludes that all are met with the proposed solution. Inaddition, eCAMS is operated in full HIPAA-compliance in Michigan and Washington. eCAMS currentlyprocesses HIPAA-compliant code and transaction sets in the approved electronic formats and has aflexible design allowing the MMIS to be readily adjusted to accommodate future changes in regulationsand code set standards. Team Noridian is in the process of upgrading to 5010 transactions to meet thecompliance date of January 1, 2012, and the planning is underway for accommodating ICD-10 as well.Team Noridian incorporates the necessary processes and procedures to ensure the MMIS and businessoperations are fully compliant with HIPAA regulations regarding standards for privacy, security, andindividually identifiable health information. Team Noridian understands the broader issues concerningHIPAA privacy and security regulations. The major goal of the privacy rules are to ensure that anindividuals’ health information is properly protected while allowing the flow of health information tocontinue, thus promoting the availability of quality health care. HIPAA privacy rules must be translatedinto a comprehensive security policy with governance that permits the use of information, whileprotecting the privacy of members.7 | 58