Preparing State I/DD Systems for Implementation of the Medicaid Access Final Rule

Health Highlights

November 21, 2024

Overview
This spring, the Centers for Medicare & Medicaid Services (CMS) finalized a highly anticipated rule that, among other things, updates program standards and processes for Medicaid home- and community-based services (HCBS), including HCBS for people with intellectual and developmental disabilities (I/DD).¹ The rule, “Ensuring Access to Medicaid Services” (or the “Access Rule”), establishes or updates requirements for state HCBS incident management systems, payment reporting and adequacy, grievance systems, and access and quality reporting. It also creates new process requirements for when states seek to reduce or restructure rates, and new transparency requirements for publishing fee-for-service HCBS rates. Effective dates vary by provision, ranging from July 2024 to July 2030. States need to begin assessing their HCBS program policies, processes, and IT infrastructure now to be prepared to fully implement the changes required by the Access Rule within required timelines. Critically, implementation necessitates: Significant investment in IT infrastructure changes or new builds; Close collaboration across Medicaid and I/DD programs; and Sustained engagement with community partners and individuals receiving services, their families, and caregivers.

Overview

This spring, the Centers for Medicare & Medicaid Services (CMS) finalized a highly anticipated rule that, among other things, updates program standards and processes for Medicaid home- and community-based services (HCBS), including HCBS for people with intellectual and developmental disabilities (I/DD).¹ The rule, “Ensuring Access to Medicaid Services” (or the “Access Rule”), establishes or updates requirements for state HCBS incident management systems, payment reporting and adequacy, grievance systems, and access and quality reporting. It also creates new process requirements for when states seek to reduce or restructure rates, and new transparency requirements for publishing fee-for-service HCBS rates. Effective dates vary by provision, ranging from July 2024 to July 2030.

States need to begin assessing their HCBS program policies, processes, and IT infrastructure now to be prepared to fully implement the changes required by the Access Rule within required timelines. Critically, implementation necessitates:

Significant investment in IT infrastructure changes or new builds;
Close collaboration across Medicaid and I/DD programs; and
Sustained engagement with community partners and individuals receiving services, their families, and caregivers.

People with I/DD account for almost one-third of total Medicaid expenditures, including those through HCBS programs.² These individuals rely on Medicaid HCBS to support their independence, self-determination, and their ability to live in their homes and participate in their communities. The changes required by the Access Rule—and how states implement those changes—will have far reaching impact on state I/DD systems and the people they serve.

While this article highlights key provisions and related implementation considerations for state I/DD programs, it does not reflect the full universe of changes states will need to make to their HCBS programs. It is also unclear at this time what changes, if any, the incoming Trump Administration will seek to make to the Access Rule. The president-elect has indicated relatively little about his health policy priorities for his second term, though potential actions could include rolling back portions of the Biden Administration’s rulemakings, including those on Medicaid eligibility and enrollment, access, and managed care oversight. For more on the implications of the election on health policy, see here.

Click the header to expand for Access Rule requirements and state considerations

Incident Management Systems and Critical Incident Reporting

Access Rule Requirements

The Access Rule establishes a comprehensive minimum definition of “critical incident” and requires states to:

Operate and maintain an electronic incident management system that “identifies, reports, triages, investigates, resolves, tracks, and trends critical incidents” using a variety of data sources (e.g., HCBS providers, adult and child protective services);
Establish data-sharing agreements with any entity that investigates critical incidents; and
Meet a higher performance standard (from 86% under the current rules to 90%) for initiating and completing critical incident investigations and corrective actions within state-specified timeframes.

Most of these requirements take effect July 2027. However, states have a five-year implementation timeline for the requirement to establish an information system that enables electronic critical incident data collection, tracking, and trending.

Considerations for State I/DD Systems

States must create more robust HCBS incident management systems that are integrated across impacted programs and functions. One of the key considerations for states will be whether to have a single incident management process and IT system across all HCBS programs (I/DD, aging, physical disabilities, behavioral health) or to maintain separate program-specific approaches, ideally with interoperable IT systems. This decision will inform the implementation approach and the extent of collaboration among state programs and agencies, need for formal agreements, required data-sharing, and related changes to IT infrastructure. CMS acknowledges that many states will need to make significant investments in IT infrastructure and data sharing to comply with the new and updated electronic critical incident management system requirements.³

Regardless of whether states choose to operate a single or multiple incident management processes/IT systems, states will need some level of standardization and will need to establish clear roles, responsibilities, and governance across IT systems to ensure that organizations required to collaborate and access systems can comply with Access Rule requirements while meeting privacy standards.

States will also need to evaluate existing, and potentially establish new, data sharing processes to incorporate the extensive list of required sources, including claims data, Medicaid fraud units, adult and child protective services. States will need to train providers and other parties that have a role in the process, and consider incentives and enforcement measures for timely and accurate incident reporting and response. Partnerships and timely data sharing with investigating entities will be critical to eliminate the need for potentially duplicative investigations that Access Rule requires in instances where investigating entity does not report on the outcomes in a timely manner.

Payment Adequacy

Access Rule Requirements

In its rulemaking, CMS cited evidence tying low wages and limited benefits to a shortage of HCBS direct care workers. In response, the Access Rule requires that:

Providers spend at least 80 percent of all Medicaid FFS payments on “compensation” for direct care workers providing personal care, home health aide, or homemaker services, but not habilitative services.
States report the percentage of payments that go to compensation for direct care workers providing personal care, home health aide, homemaker services, and habilitative services.

Workers providing services under a self-directed model and Indian Health Services and Tribal health Programs are exempted from this standard. States begin reporting on compensation percentages beginning 2028 and come into compliance with the 80 percent payment adequacy standard by July 2030.

Considerations for State I/DD Systems

Service and direct care worker definitions may be different across delivery systems and programs (e.g., those that serve people with I/DD versus seniors with age-related disabilities). States must first identify which services and direct care worker types fall under the payment adequacy requirements. States will then need to collect information from providers on compensation, ideally building on existing provider reporting processes where possible. Updates to policies and provider contracts may be required to ensure compliance, as well as additional incentives or enforcement mechanisms. States should provide training and technical assistance to providers on the new reporting requirements to ensure they are gathering accurate and consistent data and may consider hardship exemptions for small or rural providers.

States will also need to review their rate models and assumptions—including bundled rates—to reflect the costs of service delivery and whether current compensation assumptions are appropriate to achieve the required rate proportion that will need to be directed towards compensation, and, potentially, set new provider rates. States should also update their IT infrastructure to capture rates and billing information and build data collection and analytics capacity to perform required calculations and reporting.

Grievance System

Access Rule Requirements

The Access Rule requires states:

Establish a grievance process for individuals receiving HCBS.
Accept grievances orally or in writing.
Provide individuals a chance to present evidence and resolve grievances within 90 days of receipt.
Ensure grievance system is accessible to individuals receiving services and must accommodate grievances related to a state’s or provider’s performance regarding the requirements for person-centered planning, service plans, and HCBS settings requirements.

These requirements will take effect July 2026.

Considerations for State I/DD Systems

The Access Rule introduces and standardizes expectations around an important tool that will provide states with insight into individuals’ experiences with person-centered planning and states’ compliance with the HCBS settings rule. Developing a robust grievance process can significantly improve a state’s ability to address specific issues raised by individuals or their supporters and monitor and address trends through quality improvement strategies. While many states have mechanisms to capture and address complaints, the Access Rule pushes states to formalize those processes and adopt standards for accessibility, accountability, and responsiveness.

Similar to considerations related to incident management system requirements, states will need to review and update their existing processes, policies and data systems, as well as develop or update IT infrastructure for data collection and analysis. Some states may also consider whether grievance process and IT infrastructure alignment is needed across some or all impacted HCBS programs. States should assess how information obtained from grievance process can be used for continuous quality improvement, connection to protective services, and alignment with incident management processes, and provider oversight.

State Reporting, Disclosure, and Website Accessibility

Access Rule Requirements

The Access Rule includes various state reporting and disclosure requirements to foster transparency and accessibility of information for community partners, including individuals receiving services and their families. Areas with new or enhanced reporting requirements include (but are not limited to):

Direct worker compensation payments and average hourly payment rates for direct care services, including habilitation services;
Timely initiation and adequacy of hours authorized for personal care, home health aide, homemaker, and habilitation services;
Mandatory HCBS quality measures;
Biannual assessment of critical incident management systems; and,
1915(c) waiver programs’ impact on type, amount, and cost of State Plan services, waiting list maintenance, and reassessment of functional need and service plan updates.

For the majority of required reporting and disclosures, states must aggregate and publish those reports on a single website. This requirement takes effect July 2027.

Considerations for State I/DD Systems

The reporting, disclosure, and website accessibility requirements necessitate states aggregate data that is typically maintained across multiple disparate IT systems. This will require data sharing arrangements, data governance and analytics to link data sets so that information can be meaningfully interpreted and made accessible for disclosure and website publication.

Bottom Line for States and Implementation Partners

States need to consider the significant IT infrastructure and data system updates needed to support the majority of these federal requirements. They should begin engaging now with entities responsible for IT system development to conduct a gap assessment relative to the requirements, develop a gap filling plan, and identify funding sources (e.g., enhanced 90/10 FFP for IT systems) to support changes needed. States should also establish robust collaborative partnerships across delivery systems/sectors and among key implementation partners, such as case management entities, providers, advocates, direct care workers, and other community partners. States must engage individuals receiving services and their families and caregivers in design and implementation of all Access Rule provisions to ensure information and new processes are fully accessible, provide necessary accommodations and supports, and spread awareness about helpful resources. States should also begin developing intentional and effective governance structures, as well as community partners engagement plans, both of which will be foundational for successfully operationalizing the Access Rule’s HCBS provisions.

_{¹ While there is no single definition for I/DD, it encompasses conditions like autism spectrum disorder, cerebral palsy, Down syndrome, and other intellectual and developmental disorders that affect mental and physical functioning. Sheryl A. Larson et al., In-home and Residential Long-Term Supports and Services for Persons with Intellectual or Developmental Disabilities: Status and Trends 2017 (Minneapolis, MN: Research and Training Center on Community Living, Institute on Community Integration, 2020).}

_{² Medicaid Spending by Enrollment Group}

_{³ Enhanced federal financial participation (FFP) may be available to support implementation efforts.}