What Is Medicaid MMIS and How Does It Work?

A Medicaid Management Information System, or MMIS, is the computer system a state uses to run its Medicaid program: it processes provider claims, tracks who is enrolled, pays providers, and sends program data to the federal government. Every state is required to operate one as a condition of receiving federal Medicaid funding, under Section 1903 of the Social Security Act. With roughly 69 million people enrolled in Medicaid nationwide, these systems move an enormous volume of transactions each day.

What the System Does

Federal regulations describe an MMIS as a system “used to process claims for Medicaid payment from providers of medical care and services furnished to beneficiaries under the medical assistance program and to perform other functions necessary for economic and efficient operations, management, monitoring, and administration of the Medicaid program.”¹ In plain terms, it is the hub that connects providers, the state agency, managed care organizations, and CMS.

That broad job breaks down into several concrete functions:

Claims processing. The system receives claims from providers, checks them against eligibility records and billing rules, and either approves or denies payment. For pharmacy claims, some states run a point-of-sale system that does eligibility checks and adjudication in real time at the pharmacy counter.²
Provider management. The system screens, enrolls, and maintains records on every provider participating in the state’s Medicaid program.
Beneficiary eligibility and enrollment. The MMIS determines whether individuals qualify for Medicaid, enrolls them, and assigns them to managed care or fee-for-service as appropriate.
Managed care administration. Where states use managed care, the system handles enrollment into plans, processes the encounter data those plans submit, and tracks capitation payments.
Financial management. It calculates fee-for-service payments, manages recoupments and drug rebates, and tracks third-party liability.
Reporting and analytics. Data from the system feeds warehouses used for program evaluation, fraud detection, and policy work.

Who Runs It and Who Uses It

State Medicaid agencies are the primary administrators. Each state operates its own MMIS, or contracts with a private vendor to operate one, tailoring the system to state program rules while staying within federal guardrails. Day-to-day work — configuring claims edits, managing provider networks, running reports — falls to state staff and their contractors.

Most states do not build the system in-house. Federal rules let states hire private contractors, typically called fiscal agents, to design, develop, and operate the MMIS, and vendors are normally selected through competitive procurement.³ The state sets the policy; the vendor translates those rules into system logic, runs the infrastructure, and handles the mechanics of claims adjudication. Selecting a new vendor can take years and involve hundreds of millions of dollars in contract value.

CMS provides federal oversight. It certifies state systems to confirm they meet regulatory standards, and that certification is what unlocks enhanced federal funding for system costs.⁴ CMS also monitors ongoing compliance and can request full access to the system for oversight.

Providers are the most frequent external users. They submit claims electronically, verify patient eligibility before delivering services, check remittance advice to reconcile payments, and manage prior authorizations. Beneficiaries interact with the system indirectly, every time a provider checks their coverage or bills a claim on their behalf.

How MMIS Is Funded

The federal government pays a large share of MMIS costs, but the split depends on what the state is doing. For design, development, and installation of a new system or module, the federal share is 90 percent and the state pays 10 percent. For ongoing maintenance and operations, the split shifts to 75 percent federal and 25 percent state.⁵ Those rates come from Section 1903(a)(3) of the Social Security Act.

The enhanced rates are not automatic. States have to meet 22 conditions for enhanced funding under 42 CFR 433.112. Some are practical: the system must process claims accurately and on time. Others are architectural: the system must use a modular, flexible design with open interfaces and exposed application programming interfaces.⁶ States also have to give the federal government a royalty-free license to software developed with 90 percent federal funds, and the system must safeguard beneficiary information under federal privacy rules.

If a system falls out of compliance after approval, the federal match for operations can drop from 75 percent to 50 percent for the non-compliant components.⁵ That 25-percentage-point penalty gives states a real financial reason to keep their systems in shape.

From One Big System to Modular Design

For decades, most states ran the MMIS as a single, massive integrated platform. These monolithic systems were expensive to maintain and hard to update, because changing one component risked breaking another.

CMS now pushes states toward a modular approach called the Medicaid Enterprise System, or MES. Instead of one giant system, a state builds or buys separate, interoperable modules that each handle a specific function. In 2022, CMS formally replaced its older certification process with a Streamlined Modular Certification process that evaluates individual modules rather than requiring a state to certify the entire system at once.⁷ In 2025, CMS folded Electronic Visit Verification certification into that same framework.

A modern MES typically breaks the work into modules such as:

Claims processing for fee-for-service claims.
Eligibility and enrollment.
Provider management.
Financial management, covering payments, recoupments, drug rebates, and capitation.
Pharmacy benefit management, including preferred drug lists and rebates.
Program integrity for fraud, waste, and abuse detection.
Decision support and data warehouse for analytics.
Member management for plan assignment.
Third-party liability, so Medicaid pays only as the payer of last resort.
Electronic visit verification for in-home personal care and home health services.

The modular approach gives states more flexibility. A state can replace its pharmacy module without touching claims processing, or upgrade eligibility on a different schedule than financial management.⁸ The tradeoff is complexity: every module has to communicate with every other module through standardized interfaces, and managing many vendor contracts is harder than managing one.

Reporting Data to the Federal Government

Every state MMIS feeds data into a national system called the Transformed Medicaid Statistical Information System, or T-MSIS. This is how CMS collects standardized information from all states for oversight, research, and policy. T-MSIS is now the largest national resource of Medicaid and CHIP beneficiary information.⁹

States submit files covering beneficiary demographics and eligibility, claims in four categories (inpatient, long-term care, other services, and prescriptions), financial transactions, provider characteristics, and managed care information. CMS runs data quality checks and works with states to improve accuracy and completeness. Section 1903(r) of the Social Security Act requires state systems to be capable of transmitting this data electronically in the formats CMS specifies, and to be compatible with Medicare systems, including uniform provider and beneficiary identification codes.¹⁰

Security, Privacy, and Program Integrity

Because an MMIS holds sensitive health information on millions of people, it has to meet strict federal security standards. The HIPAA Security Rule requires technical safeguards on any system handling electronic protected health information: access controls, audit logs, integrity protections, user authentication, and encryption for data in transit. Beyond HIPAA, the conditions for enhanced federal funding require states to safeguard system information under 42 CFR Part 431, Subpart F and to align with health IT standards adopted by the Office of the National Coordinator for Health IT.⁶ Systems also have to meet accessibility standards under Section 508 of the Rehabilitation Act.

The system is also the state’s main tool for protecting program money. Medicaid spends hundreds of billions of dollars a year, and the program integrity module analyzes claims data to identify unusual billing patterns, flag potential fraud, and track providers whose behavior deviates from expected norms. States are required to make information on probable fraud or abuse available to their Medicaid fraud control units.¹¹ Federal law also requires the MMIS to incorporate the National Correct Coding Initiative, the same methodology Medicare uses to prevent improper billing through unbundling and other coding errors.¹⁰

The data flowing through MMIS ultimately shapes how a state runs Medicaid. Spending trends, utilization patterns, health outcomes, and provider performance all become visible through the system. When a state considers expanding a benefit, tightening an eligibility rule, or targeting a public health intervention, the evidence behind that decision comes from the MMIS.

1
eCFR. 42 CFR Part 433 Subpart C – Mechanized Claims Processing and Information Retrieval Systems
2
eCFR. 42 CFR 456.722 – Electronic Claims Management System
3
Medicaid.gov. Medicaid Management Information System
4
Centers for Medicare & Medicaid Services. Medicaid Enterprise Certification Toolkit Overview
5
Federal Register. Medicaid Program; Mechanized Claims Processing and Information Retrieval Systems (90/10)
6
MES Certification Repository. Conditions for Enhanced Funding
7
Medicaid.gov. Streamlined Modular Certification
8
Centers for Medicare & Medicaid Services (CMS). SMC Certification Guidance
9
Medicaid.gov. Transformed Medicaid Statistical Information System (T-MSIS)
10
Social Security Administration. Social Security Act Section 1903
11
eCFR. 42 CFR 433.116 – FFP for Operation of Mechanized Claims Processing and Information Retrieval Systems