Medicaid Managed Care — Federal Requirements for State Medicaid MCO Programs, Enrollee Rights, and Grievance Systems

Legal Authority

• 42 U.S.C. § 1302 — Social Security Act § 1102; grants the HHS Secretary general rulemaking authority to administer the Medicaid program; the regulatory basis for CMS's authority to prescribe requirements for managed care organizations operating in Medicaid
• 42 U.S.C. § 1396b(m) — Social Security Act § 1903(m); authorizes federal matching payments to states for capitation payments to MCOs that meet federal requirements; establishes the conditions MCOs must satisfy to receive federal Medicaid funds
• 42 CFR Part 438 — CMS Medicaid managed care regulation; establishes comprehensive standards for state MCO contracts, network adequacy, quality, enrollee rights, grievance and appeal systems, external quality review, program integrity, and actuarial soundness of capitation rates

Key Mechanics

Medicaid managed care operates through state-MCO contracts: the state pays a monthly capitation rate (per-enrollee-per-month) to private health plans, which then bear the risk of providing all covered Medicaid benefits. CMS regulates the terms of those contracts under 42 CFR Part 438. Key requirements: Network adequacy — MCOs must maintain provider networks sufficient to ensure enrollees can access all covered services within time-and-distance standards set by CMS; states must conduct network adequacy reviews at contract renewal. Capitation rate actuarial soundness — state-set capitation rates must be certified by an actuary as actuarially sound, reflecting the expected cost of providing covered services. Enrollee rights and protections — Medicaid enrollees have the right to choose a primary care provider, receive a choice of MCOs (in states with multiple plans), change plans at specified times, receive notice of adverse actions, and appeal coverage denials. Grievance and appeal systems — MCOs must maintain internal grievance and appeal processes; enrollees who exhaust MCO appeals have the right to a state fair hearing. External quality review — states must contract with an independent External Quality Review Organization (EQRO) to annually validate MCO quality measures. The 2024 managed care rule (89 FR 30448) strengthened network adequacy standards, added new access monitoring requirements, and required states to collect and report MCO quality data on a standardized basis.

Current Rule (2026)

What This Rule Does

The substantial majority of Medicaid enrollees — roughly 70%+ of the program's approximately 77 million Medicaid and CHIP beneficiaries (September 2025; total enrollment fell sharply from the post-COVID PHE peak after 2023-2024 redeterminations) — receive their Medicaid benefits through a managed care organization (MCO) rather than through traditional fee-for-service Medicaid. Instead of the state paying doctors and hospitals directly for each service, the state pays a monthly capitated premium to a private health plan (the MCO), which then takes responsibility for covering the beneficiary's Medicaid benefits. 42 CFR Part 438 is the comprehensive federal regulatory framework that governs Medicaid managed care: what states must require in their MCO contracts, what rights Medicaid enrollees have, what quality standards MCOs must meet, how grievances and appeals are processed, and what happens when an MCO fails.

Medicaid managed care has expanded dramatically since the early 1990s because states sought to control Medicaid costs, improve care coordination, and bring predictability to their budgets. The managed care model shifts financial risk from the state to the MCO — if the MCO's costs exceed the capitation payment, the plan bears the loss. Part 438 creates the federal floor of requirements that every Medicaid managed care program must meet, regardless of which state you're in. States can add requirements beyond Part 438 (and many do), but they cannot waive the federal minimums.

Part 438 applies to several types of managed care entities:

• MCOs (Managed Care Organizations): full-risk, comprehensive health plans covering medical, behavioral health, and other services; the dominant model
• PIHPs (Prepaid Inpatient Health Plans): cover only inpatient services (rare)
• PAHPs (Prepaid Ambulatory Health Plans): cover only outpatient services (common for behavioral health carve-outs and dental plans)
• PCCMs (Primary Care Case Managers): individual physician practices paid a monthly fee to coordinate care; used in some rural states where full MCOs are impractical

Key Provisions

State Plan and Contracting Requirements (Subpart B)

• § 438.50 — State plan requirements: a state that requires Medicaid beneficiaries to enroll in MCOs must amend its state Medicaid plan; mandatory enrollment programs (where the state enrolls beneficiaries automatically without requiring them to choose a plan) must provide certain default enrollment protections

• § 438.52 — Choice of plans: states operating managed care programs must generally offer Medicaid enrollees a choice of at least two MCOs; in rural areas or where plan options are limited, CMS may approve exceptions; states cannot assign all enrollees in a county to a single MCO without demonstrating that a competitive choice model is not feasible

• § 438.54 — Enrollment procedures: if the state uses automatic enrollment (default assignment), the state must provide enrollees with a choice period of at least 90 days during which the enrollee may switch plans; the default assignment algorithm must be based on factors like prior history with a plan, geographic accessibility, or linguistic needs — not on plan cost or financial factors that favor the state

• § 438.56 — Disenrollment: enrollees may request to disenroll from an MCO during any open enrollment period; outside of open enrollment, enrollees may disenroll for "good cause" — which includes an MCO's failure to provide required services, the loss of a key provider from the network, or determination that the enrollee's care needs cannot be accommodated within the MCO; the state must have a process for evaluating and acting on disenrollment requests

• § 438.66 — State monitoring: states must have a monitoring system for all managed care programs, including ongoing review of access to care, quality of care, financial solvency of MCOs, network adequacy, and grievance and appeal resolution; states must report monitoring findings to CMS; CMS uses monitoring reports as part of its oversight of state managed care programs

Enrollee Rights and Protections (Subpart C)

• § 438.100 — Enrollee rights: MCOs must have written policies recognizing each enrollee's right to receive information about the plan and providers, to choose a primary care provider within the network, to receive services without discrimination, to request and receive a copy of their medical records, and to participate in decisions about their care; these rights must be communicated to enrollees in a language and format they can understand

• § 438.102 — Provider-enrollee communications: an MCO may not prohibit or restrict providers from discussing treatment options with enrollees, including options not covered by the MCO; the "gag clause" prohibition — which prevents MCOs from stopping providers from telling patients about all their care options, even if those options are not covered by the plan — was strengthened in the 2016 rulemaking; providers in Medicaid MCO networks retain their professional obligation to give patients complete information about their treatment options

• § 438.104 — Marketing restrictions: MCOs may not conduct "cold-call marketing" (unsolicited direct contact with potential enrollees) or engage in practices that mislead, confuse, or defraud enrollees; marketing materials must be approved by the state before use; MCOs may not make inaccurate or misleading comparisons with competitor plans

• § 438.106 — Enrollee protection from liability: Medicaid enrollees are protected from balance billing and from liability for the MCO's debts; if an MCO becomes insolvent, enrollees cannot be billed by providers for services covered under the MCO contract, even if the MCO has not paid the provider

• § 438.114 — Emergency services: MCOs must cover emergency medical care regardless of whether the provider is in-network; the "prudent layperson" standard applies — coverage cannot be denied because the emergency turns out to be less serious than it appeared to the enrollee at the time; MCOs must cover poststabilization care while the enrollee is transitioning back to in-network care

• § 438.116 — Solvency standards: MCOs must meet state-defined solvency standards that comply with federal minimums; MCOs that are not federally qualified health plans must maintain reserves sufficient to cover their covered liabilities; states must have contingency plans for an MCO insolvency that ensure continuity of care for affected enrollees

MCO Standards (Subpart D)

• Network adequacy: MCOs must maintain a network of providers sufficient to provide enrollees with timely access to all covered services; CMS's 2024 rule (89 FR 30448) strengthened network adequacy standards, including specific appointment wait-time standards for primary care, specialty care, and behavioral health services; states must verify network adequacy before approving MCO contracts and monitor it continuously

• Access standards: the 2024 final rule established federal time and distance standards for Medicaid managed care — the first time CMS set specific maximum travel time and distance requirements for different provider types; states must ensure MCOs meet these standards or provide equivalent access accommodations (telemedicine, transportation)

Grievance and Appeal System (Subpart F)

Every Medicaid MCO must have a grievance and appeal system that meets Part 438's requirements:

• § 438.400 — Definitions: a "grievance" is a complaint about any matter other than an adverse benefit determination (e.g., a complaint about provider behavior, wait times, or customer service); an "appeal" is a request for review of an adverse benefit determination (a denial, reduction, or termination of a service); an "adverse benefit determination" is any action by the MCO that denies or limits coverage

• § 438.402 — Dual grievance and appeal system: MCOs must have separate processes for grievances (complaints) and appeals (adverse benefit determination reviews); both processes must be accessible, free to enrollees, and available in multiple languages

• § 438.404 — Notice of adverse benefit determination: when an MCO denies, reduces, or terminates a covered service, it must send the enrollee written notice that includes: the action taken, the reason for the action (including the specific contractual or clinical criteria used), information about the right to appeal, and information about the right to request continuation of services during the appeal

• § 438.408 — Resolution timelines: the MCO must resolve standard appeals within 30 calendar days of receipt; the MCO must resolve grievances within 90 days; if an appeal is denied, the MCO must send written notice of the resolution with the reason and information about the right to request a state fair hearing

• § 438.410 — Expedited appeals: if the standard 30-day timeline could seriously jeopardize the enrollee's life, health, or ability to attain, maintain, or regain maximum function, the MCO must use an expedited appeal process with a resolution deadline of 72 hours; the MCO must resolve the expedited appeal and notify the enrollee within that timeframe; failure to act within 72 hours is itself an adverse determination that the enrollee can appeal to the state

Quality Measurement (Subpart E)

• MCOs must implement quality assessment and performance improvement (QAPI) programs; CMS requires MCOs to measure performance using HEDIS (Healthcare Effectiveness Data and Information Set) measures for Medicaid, submit data to the state, and participate in External Quality Reviews (EQR) conducted by independent EQR organizations (EQROs)
• States must contract with a certified EQRO to conduct annual reviews of each MCO's compliance with federal and state standards, clinical performance (HEDIS), and validation of performance improvement projects
• The Medicaid Managed Care Quality Rating System (QRS) — established by the 2016 rulemaking and expanded in 2024 — creates a standardized quality rating framework comparable to CMS's Five-Star Rating System for Medicare Advantage; states must implement the QRS to give enrollees quality information for plan selection

Sanctions (Subpart I)

• CMS may impose sanctions on an MCO that violates its contract or federal requirements; available sanctions include suspension of enrollment, civil money penalties, and termination of the MCO's contract with the state
• State agencies must have their own sanction authority over MCOs; the state and CMS have concurrent oversight — CMS's oversight focuses on state compliance with federal requirements, while states directly oversee MCO contract compliance

How It Affects You

Medicaid beneficiaries enrolled in managed care: Your plan must tell you why it denied a service, and you have the right to appeal. If you receive a notice of adverse benefit determination — which must arrive before a service is reduced or terminated, or shortly after an emergency service denial — read it carefully: it must tell you exactly why your service was denied and how to appeal. You have the right to an expedited appeal (72-hour resolution) if the standard 30-day process would seriously jeopardize your health. During your appeal, you may request continuation of services you were already receiving — the plan must continue those services pending the appeal outcome, even if it ultimately wins. If you lose your MCO appeal, you have the right to a state fair hearing administered by the state Medicaid agency.

MCO compliance and quality officers: Part 438's grievance and appeal requirements are among the most prescriptive in federal Medicaid law. The 30-day standard appeal timeline, 72-hour expedited timeline, and 90-day grievance timeline are hard deadlines — missing them is a reportable violation regardless of the outcome. Build compliance monitoring into your case management system with automatic escalation for appeals approaching deadline. The 2024 network adequacy rules include specific appointment availability standards that must be tracked as operational metrics, not just contract terms. CMS's EQRO process will verify compliance with these standards annually.

State Medicaid agencies: You are responsible for monitoring your MCOs continuously under § 438.66 — not just at contract renewal. The 2024 final rule's access standards and network adequacy requirements require active verification, not reliance on MCO self-reporting. Build data collection and reporting requirements into your MCO contracts; require MCOs to provide appointment wait-time data, network gap analyses, and grievance and appeal data on a regular basis. CMS reviews state monitoring reports as part of its oversight of your managed care program.

Healthcare providers in Medicaid MCO networks: Your contracts with MCOs cannot restrict you from telling your patients about all their treatment options, including options the MCO doesn't cover (§ 438.102). You are also protected from having to collect from enrollees — § 438.106 prohibits MCOs from making enrollees liable for the MCO's payment obligations, and this protection extends to you as a network provider. If the MCO denies a claim for a service you provided in an emergency, the MCO cannot require the patient to pay.

Statutory Authority

This rule implements:

• 42 U.S.C. § 1396b(m) — Social Security Act § 1903(m); establishes the Medicaid managed care contracting authority; defines the types of managed care entities eligible for federal matching payments; sets the foundational requirements for what states must include in MCO contracts
• 42 U.S.C. § 1302 — Social Security Act § 1102; general regulatory authority for the Secretary of HHS to prescribe regulations as necessary for the efficient administration of the Social Security Act, including Medicaid

Recent Rulemakings

• 2024 (89 FR 30448): Medicaid Managed Care Access, Finance, and Quality final rule — the most significant managed care rulemaking in nearly a decade; established first-ever federal appointment wait-time standards for Medicaid MCOs (e.g., primary care within 15 business days for routine care, 10 business days for routine specialty care); strengthened network adequacy standards; required annual review of capitation rate ranges; expanded quality rating requirements; effective in phases 2024–2027
• 2016 (81 FR 27497): Comprehensive update to Part 438 — first major rewrite since 2002; established the Medicaid Managed Care Quality Rating System (QRS); aligned Medicaid managed care rules with ACA marketplace coverage requirements; strengthened enrollee protections; clarified the grievance and appeal framework to distinguish grievances from appeals

Pending Action