CMS Audit Checklist: What EDE and SBE Entities Must Have Ready
A CMS audit checklist matters most in the weeks before a review, when an Enhanced Direct Enrollment or State-Based Exchange entity discovers whether the evidence a reviewer expects is staged or scattered. Reviewers tend to ask for the same core items first, so knowing what those are, and having them ready, is the difference between an audit that confirms your program and one that surfaces gaps under time pressure. This checklist sets out the documentation, security evidence, and submission items that EDE and SBE entities should have ready, and points to the deeper guidance for each. The reason to prepare against a checklist rather than react to an audit is that these reviews are recurring and scheduled, not surprises. An EDE entity’s Operational Readiness Review and the ongoing obligations that follow it run on a known cadence, so the evidence is either maintained continuously or assembled in a scramble. The entities that fare well treat the checklist as a standing state to maintain rather than a task to complete once. Who Faces a CMS Audit Two kinds of entity are the focus here. Enhanced Direct Enrollment entities are the web-brokers and issuers that integrate directly with the federal Exchange through its API suite to enroll consumers in marketplace coverage, and they undergo an Operational Readiness Review before they are authorized and remain subject to ongoing oversight afterward. State-Based Exchanges are the marketplaces that states operate themselves, and they carry their own CMS oversight and reporting obligations. Both handle consumer personally identifiable information at scale, which is why CMS holds them to privacy and security requirements and verifies compliance through audit. The common thread is that these audits test whether an entity protects consumer information the way the requirements demand, and whether it can prove it. Elevate’s CMS EDE services support entities through readiness and audit, and the guide to an upstream EDE entity’s high-level privacy and security obligations covers the obligations these audits verify. The checklist below is what those obligations look like as a set of items to have ready. The CMS Audit Checklist The items reviewers look for fall into four categories, and the table maps each to what to have ready and why it draws attention first. It is a starting map rather than the full, entity-specific requirement set, which depends on your role and scope. Category What to have ready Why reviewers look here first Documentation System Security Plan, policies and procedures, data flow and PII mapping It defines your scope and how consumer PII is handled Security evidence Control implementation evidence, penetration test results, vulnerability scans It shows controls actually operate, not just exist on paper Continuous monitoring Ongoing monitoring records and periodic evidence It shows the program is sustained between audits, not revived for them Submission items Required attestations and submissions by their deadlines It determines authorization status and timing The pattern across these categories is that documentation defines the program, security evidence proves it operates, continuous monitoring proves it persists, and submissions record it with CMS on time. A reviewer who finds strong documentation but no evidence of operation, or evidence that stops after the last audit, has found the gap that most often causes trouble. Preparing each category to stand on its own, rather than leaning on the documentation alone, is what makes a review straightforward. Documentation to Have Ready The documentation layer establishes what your system is, how it handles consumer information, and what controls govern it, and it is where a reviewer orients before anything else. The core artifacts are a current System Security Plan that describes the system and its controls, the policies and procedures that govern how the entity operates, and a data flow and PII mapping that shows where consumer information enters, moves, and rests. That mapping is worth particular attention, because a reviewer uses it to understand scope, and gaps in it undermine everything built on top. The practical test for this layer is whether the documentation matches reality. Documentation that describes controls the entity does not actually run, or omits data flows that exist, creates findings even when the underlying security is sound. The guide to data flow and PII mapping for EDE issuers covers how to build that mapping so it holds up under review. Security Evidence Reviewers Ask For Where documentation describes controls, security evidence proves they operate, and this is the layer entities most often underprepare. Reviewers look for evidence that the controls in the System Security Plan are actually implemented and working: results from penetration testing, vulnerability scans and the remediation that followed them, records showing access is controlled and reviewed, and evidence that incidents would be detected and handled. The principle is that a control described but not evidenced is treated as a control not operating. Building this evidence is not a task to start when an audit is scheduled, because much of it, particularly the record of controls operating over time, cannot be created retroactively. The guide to building controls and evidence for successful CMS audits covers how to stand up that evidence base, and continuous monitoring with quarterly evidence covers how to keep it current between reviews so it is always ready. Submission Items and Deadlines The submission layer is where preparation meets the calendar. CMS audits and the obligations around them come with required attestations and submissions that must arrive by specific deadlines, and missing a window can affect authorization regardless of how strong the underlying program is. Knowing what is due and when, and staging the materials in advance, is as much a part of readiness as the security work itself. Because the deadlines and submission windows are date-specific and change year to year, they are best tracked against a current calendar rather than memory. The CMS audit timeline lays out key deadlines and response timeframes. When a review does surface issues, they are documented and tracked to closure, and the guide to CMS audit reporting, deficiencies, and plans of action and milestones covers how
CMS EDE Audit Readiness: What Your Final Mock Review Must Cover Before Sign-off
CMS EDE audit failures carry serious consequences. Organizations face up to $1.5 million per violation each year. 71% of companies acknowledge their compliance programs fall short, and 54% still rely on manual processes that introduce substantial risk. CMS audit protocols review whether your operations meet Medicare requirements consistently. The agency uses Industry-Wide Timeliness Monitoring to measure plans with rigor. We’ve developed this piece to walk you through what your final mock review must cover before sign-off. We’ll get into CMS program audit protocols and high-risk data validation areas. You’ll also learn about testing processes and the documentation standards CMS expects during audits to ensure your organization achieves audit readiness. CMS Program Audit Protocols for EDE Compliance Understanding CMS program audit protocols requires familiarity with how the agency structures its oversight activities across different review types. CMS conducts completeness reviews on all prospective primary EDE Entity audits submitted within applicable submission windows. The approval process involves multiple resubmissions and takes many months after an audit submission has been deemed complete. This can extend up to a year or more depending on the quality of your EDE environment build and documentation. How CMS Monitors Success of Recovery Audits in EDE Context CMS uses MA encounter data for program integrity purposes. Contractors analyze encounter data to identify providers with patterns that may show fraud, waste and abuse. The agency conducts Risk Adjustment Data Validation audits to determine whether diagnoses reported in encounter data are supported by beneficiaries’ medical records, though this process has experienced significant delays. CMS performs automated checks for data consistency and validity as part of accepting data, and MAOs receive reports regarding acceptance or rejection of submitted data. The agency has developed standards for submission performance based on meeting eight thresholds and sends reports to MAOs showing compliance status. Documentation Standards CMS Expects During Audits Each prospective and approved primary EDE Entity must maintain a testing environment that represents the EDE production environment and integration with the EDE pathway accurately. This includes functional use of all EDE APIs. Changes deployed to production must be deployed to the test environment mirroring production concurrently. You cannot submit test data to FFE Production Environments. CMS requires retention of independent third-party Auditors to perform operational readiness reviews that prove compliance with EDE program requirements. Common Audit Triggers and Red Flags CMS identifies MAOs with persistent rates of rejected encounter data and contacts them to understand reasons causing high rejection rates when submitting data. Billing patterns that deviate by a lot from statistical norms flag practices for review automatically. Frequent claim denials, resubmissions or corrections signal systemic billing problems that increase audit likelihood. Difference Between Desk Reviews and On-Site EDE Audits Recovery Audit Contractors conduct both automated reviews at the system level and complex reviews requiring qualified individuals to get into medical records. Automated reviews occur without medical record examination, while complex reviews necessitate Additional Documentation Requests. CMS will continue ongoing oversight of each EDE Entity through regular monitoring of production and testing environments for completeness and accuracy. High-Risk Data Validation Areas Your Mock Review Must Test Your mock review testing protocol must focus on six validation areas where cms data validation audits identify the highest failure rates. These areas represent the intersection of technical complexity and regulatory scrutiny. Duplicate Encounter Detection and Prevention Duplicate submissions are one of the leading causes of rejections and poor encounter data quality. Between 1% and 16% of service records were identified as duplicates across MA encounter data files by provider type. Your testing environment needs to implement unique encounter identifiers that combine member ID, date of service, rendering provider and visit number to prevent repeated posting. Incomplete Encounters Missing Required Fields Claims submitted with incomplete or invalid information may be returned as unprocessable. Item 11 on CMS-1500 forms must be completed as a required field. Providers must acknowledge good faith efforts to determine whether Medicare is primary or secondary payer. Wrong patient demographics in Boxes 1 through 13 trigger automatic denials. 68% of providers cite inaccurate patient intake data as the main cause of claim denials. Diagnosis and Procedure Code Validation Rules The FY 2026 ICD-10-CM code update introduced 614 new codes, deleted 28 and revised 38. Missing or incorrect diagnosis pointers in Box 24E prevent payers from determining medical necessity. Medical record validation studies show 72.3% of primary diagnosis coding and 70.1% of primary procedure coding in encounter data is complete and accurate. Member Attribution and Eligibility Verification Producers must make sure the combination of Member Identifier, Payer Identifier, Contract Identifier and Plan Identifier are unique. Attribution lists must include coverage references and attributed periods in Group.member.period data elements. Timely Filing and Submission Window Compliance The maximum period for submission of all Medicare fee-for-service claims is 12 months, or 1 calendar year, after the date of service. Medicare denies claims for untimely filing when the receipt date exceeds this window. Third-Party Liability and Coordination of Benefits Errors Medicaid is the payer of last resort. States must take all reasonable measures to find out legal liability of third parties. This includes health insurers, MCOs and group health plans. COB makes sure claims are paid correctly by identifying health benefits available and coordinating the payment process. Mock Review Testing Process and Quality Gates Building a mock review testing framework starts with environment configuration that mirrors your production systems. Each testing environment should represent your EDE production environment and integration with the EDE pathway accurately, including functional use of all EDE APIs. Changes deployed to production require concurrent deployment to test environments. Setting Up Your Testing Environment and Sample Selection CMS selects targeted samples from submitted universes to test during audit field work. Sample sizes vary by program area. Your internal mock review should follow similar sampling methodology and select representative cases from high-risk validation areas you identified previously. Running Automated Validation Scripts and Manual Checks Manual data validation drains time and confidence from analytics processes. Small inconsistencies slip through. Scripts turn manual checks into repeatable logic that runs
CMS Audit Failures: Securing API Integration Points Before Your Next Review
CMS audit failures can cost your organization up to $1.5 million per violation annually, yet 71% of companies admit their compliance programs fall short. Hacking and IT incidents now account for the majority of large healthcare data breaches, with API integration points serving as vulnerabilities. More than that, 54% of organizations still rely on manual processes that introduce risk. So securing API integration points is essential to maintain CMS audit requirements and avoid violations that get pricey. This piece walks you through understanding audit IT security protocols, identifying common API integration failures, implementing resilient security controls, and preparing a complete CMS audit checklist that ensures your infrastructure passes review with confidence. Understanding CMS Audit Requirements for API Integration Points HIPAA Security Rule Technical Safeguards for APIs HIPAA Security Rule establishes five technical safeguards that govern API implementations handling ePHI. Access controls require unique user identification and emergency access procedures as required specifications, while automatic logoff and encryption remain addressable. Audit controls mandate hardware, software, or procedural mechanisms that record and get into activity in systems containing ePHI. Integrity controls protect ePHI from improper alteration or destruction. Authentication controls verify that persons or entities seeking access are who they claim to be. Transmission security guards against unauthorized access to ePHI transmitted over electronic networks. These safeguards just need encryption for data at rest and in transit, strict access controls limiting ePHI interaction to authorized personnel, and detailed audit logging for every API interaction. CMS Interoperability and Patient Access Final Rule Mandates The 2020 CMS Interoperability and Patient Access final rule (CMS-9115-F) requires Medicare Advantage organizations, Medicaid fee-for-service programs, Medicaid managed care plans, CHIP programs, and QHP issuers on Federally-facilitated Exchanges to implement API technology to exchange health data. Impacted payers must maintain Patient Access APIs making claims, encounter, and clinical data available no later than one business day after claim adjudication, starting January 1, 2021. The 2024 final rule (CMS-0057-F) adds three more APIs: Provider Access API, Payer-to-Payer API, and Prior Authorization API, with implementation deadlines by January 1, 2027. More, impacted payers must report metrics on Patient Access API usage starting in 2026, including total unique patients whose data are transferred via the API. FHIR API Standards and Data Exchange Requirements CMS adopted HL7 FHIR Release 4.0.1 as the foundational standard to exchange data via secure APIs. All required APIs must meet technical standards finalized at 45 CFR 170.215, with ONC-approved updated versions permitted under specific conditions. FHIR uses RESTful API commands (GET, POST, PUT, DELETE) and modular Resources representing healthcare concepts in XML, JSON, or RDF formats. The United States Core Data for Interoperability (USCDI) version 1 defines the minimum data elements payers must exchange. Implementation guides like CARIN for Blue Button provide standardized approaches and eliminate the need for independent development. Shared Responsibility Model in Cloud-Based API Deployments Cloud deployments operate under a shared responsibility framework where responsibilities vary by service type. You manage virtual machines, operating systems, and applications while the provider secures physical infrastructure in IaaS environments. PaaS shifts OS and runtime management to providers, but you remain responsible for application configuration and access controls. Whatever deployment type, you always retain responsibility for data classification, encryption decisions, endpoint protection, account management, and access control implementation including role-based access control and multifactor authentication. Top 5 API Integration Failures That Trigger CMS Audit Violations Inadequate Access Controls and Authentication Mechanisms Authentication failures plague healthcare APIs. 55% of organizations experience authentication problems. Broken authentication demonstrates itself through missing JWT validation where systems fail to verify token signatures, issuer, audience, expiration, and algorithm. Weak API key management practices include using long-lived or plaintext keys, missing rotation schedules, and overbroad permissions without client binding. OAuth misconfigurations create vulnerabilities through weak redirect URI validation, missing PKCE for public clients, and misuse of grant types. These flaws enable token theft and privilege escalation, exposing PHI to unauthorized access. Missing or Incomplete Audit Trails for PHI Access Inadequate audit trails constitute direct violations of HIPAA and CMS guidelines. Complete logging requires capturing user identification, timestamps, and accessed resources for every API interaction with ePHI. Systems must record user login attempts, permission changes, PHI access events, and database modifications. Organizations cannot demonstrate compliance during CMS audit protocols or break down security incidents effectively without complete audit logging. Unencrypted Data Transmission and Storage Gaps Unencrypted data transmission remains a critical failure point. Medical professionals send unencrypted PHI regularly. 60% admit to sending work-related texts and 30% receive unencrypted PHI via text message. Plaintext email attachments, legacy FTP transfers, unsecured APIs, and medical device telemetry expose ePHI during transmission. TLS 1.2 or higher with strong cipher suites is mandatory to protect health information in transit. Broken Authorization Leading to Unauthorized PHI Exposure BOLA attacks occur when attackers manipulate patient identifiers in API requests to access unauthorized records. An attacker changes GET /api/patients/12345/labs to /api/patients/67890/labs and accesses another patient’s results. Object level authorization failures result from insufficient validation that logged-in users have permissions to access requested objects. Insufficient Consent Management and Data Minimization Controls APIs must enforce the minimum necessary standard and limit ePHI disclosure to what’s required for the stated purpose. Consent management systems store policies, evaluate access queries against stored consents, and make access determinations to enforce privacy priorities. Field-level whitelisting ensures endpoints return only approved attributes rather than entire health records. Implementing Secure API Controls for CMS Audit Readiness OAuth 2.0 and OpenID Connect for Authentication OAuth 2.0 handles authentication and delegation. Scoped permissions restrict access to resources that are needed. To cite an instance, a telehealth API should assign separate OAuth 2.0 client IDs to each third-party app instead of shared API keys. Patient-facing apps receive tokens with scopes like patient/.read for read-only access. Clinician portals use user/.read and user/*.write for controlled data interaction. TLS 1.2+ Encryption and Transmission Security Use TLS 1.2 or higher for all endpoints and disable weak ciphers. Enable HTTP Strict Transport Security (HSTS) to prevent plaintext HTTP connections. Strong encryption methods establish secure connections and prevent leakage of
CMS EDE Continuous Monitoring: Best Practices for Quarterly Reporting Cadence
CMS EDE systems now enforce automatic disconnection after 30 minutes of inactivity and require agents and brokers to reauthenticate their credentials. Then maintaining continuous compliance demands more than reactive responses to security prompts. Healthcare providers working with CMS EDE must conduct security risk analyzes annually. This makes systematic monitoring a requirement, not an option. We’ve developed this guide to help you establish a quarterly reporting cadence that satisfies regulatory requirements and streamlines your compliance workflow. In this piece, we’ll walk you through continuous monitoring requirements, planning your 90-day reporting cycles, implementing daily and weekly monitoring practices, and maintaining documentation standards that withstand CMS audits. Understanding CMS EDE Continuous Monitoring Requirements Compliance with CMS EDE operates as an ongoing obligation rather than a one-time achievement. Entities approved for the Enhanced Direct Enrollment pathway must maintain strong compliance programs with structured quarterly reporting to CMS. What CMS EDE monitoring covers The Information Security and Privacy Continuous Monitoring Strategy Guide establishes the foundations for all CMS EDE oversight activities. Existing EDE entities must complete an annual assessment of security and privacy controls conducted by an independent auditor. This assessment is part of a broader continuous monitoring framework that requires monthly vulnerability scans of all IT systems. You must submit scan reports from the previous three months during quarterly reviews. CMS conducts ongoing oversight of each EDE entity’s end-user experience in production and testing environments. Your testing environment must accurately represent your production setup and integrate with all EDE APIs. Primary EDE entities integrate with more than 20 APIs that make eligibility, enrollment and post-enrollment experiences easier. More, any changes implemented in production must appear in your testing environment at the same time. Regulatory framework and compliance mandates The regulatory foundation stems from 45 C.F.R. 155.221(f)-(h), which mandates that prospective primary EDE entities and phase change entities retain independent third-party auditors to perform Operational Readiness Reviews. These reviews confirm compliance with EDE program requirements before entities receive approval. You must sign two separate agreements with CMS. The EDE Business Agreement addresses consumer communication and operational requirements. The Interconnection Security Agreement covers privacy and security mandates. Both agreements require identification of your selected auditors to verify program compliance. Key stakeholders and their monitoring responsibilities Primary EDE entities bear the most extensive monitoring obligations. They must build platforms that integrate with the complete API suite and undergo third-party audits of their applications and privacy/security structures. They also maintain testing environments and submit continuous monitoring documentation. Upstream EDE entities that use a primary entity’s platform with only minor branding changes avoid audit requirements. But upstream entities adding functionality or systems beyond minor modifications may face audit requirements like primary entities. Independent auditors perform annual assessments of security and privacy controls as specified in the ISCM Strategy Guide. CMS maintains oversight authority across all entities and monitors user experiences while verifying compliance with established requirements. Establishing Your Quarterly Reporting Cadence Planning your 90-day reporting cycle Structuring your reporting calendar around quarterly intervals lines up with CMS practices. The 90-day reporting period provides enough time to collect complete data while you maintain consistent oversight. Your calendar year divides into four distinct quarters. Each quarter requires complete documentation of monitoring activities, security assessments and operational metrics. Data collection timelines and milestones The audit submission window opens annually on April 1st and closes July 1st at 3:00 AM EST. CMS requires two weeks or more to provide feedback on submitted packages. Submitting early in May allows adequate time to address any deficiencies and resubmit before the July deadline. You have 4.5 months to review and correct records for public reporting purposes after each calendar quarter ends. This correction window freezes permanently once the deadline passes. Timely review becomes critical. Coordination between EDE partners and CMS systems Your EDE environment must finish development before the April 1st submission window begins. Coordinate with your independent auditors to schedule assessments that allow time for package preparation. Your infrastructure and operational processes need full implementation as evidence of ongoing monitoring required in the Security and Audit Report. Monthly interim checkpoints Organizations that embed audit governance into daily workflows reshape compliance from reactive burden into proactive advantage. Run quarterly mock audits using current CMS audit protocols. Internal audits predict CMS outcomes better than other preparation activities. They spot gaps in compliance oversight before fieldwork begins. Pre-submission validation windows The 300-346 hour audit burden demands year-round readiness infrastructure. Establish quarterly internal audit cadence with defined roles across Compliance, Operations and IT. Confirm all documentation completeness before submission windows open to avoid rushed evidence gathering. Continuous Monitoring Best Practices Between Quarterly Reports Between your quarterly submission windows, ongoing monitoring activities are the foundations of CMS EDE compliance. The continuous nature of these requirements means structured daily and weekly processes prevent gaps in your audit trail. Daily transaction monitoring and error tracking CMS reviews reports on HETS Submitter usage. This includes overall volume, repetitive transactions and AAA error rates. We monitor each inquiry and associate it with its source. We accept responsibility for all eligibility transactions sent on behalf of Medicare providers or their agents. The 30-minute inactivity timer requires reauthentication when CMS systems detect no relevant activity within that timeframe. These connections happen behind the scenes, so you may face prompts to reconnect even during active EDE website use. Weekly reconciliation of enrollment data Audit record review occurs at least weekly to find indications of inappropriate or unusual activity and what it all means. We analyze system audit records every seven days and report findings to designated personnel. Up-to-the-minute security event logging Your information system must audit events based on risk assessment: User log-on and log-off (successful or unsuccessful) All system administration activities and modification of privileges Account creation, modification or deletion System access to information systems containing PII Concurrent logons from different workstations Privileged activities or system level access to PII Alert designated personnel almost immediately if an audit logging process failure occurs. Systems that don’t support automatic shutdown must halt within one hour of audit
How CMS Audit Control Mapping Ensures Consumer Data Security in the Cloud
CMS Audit control mapping addresses a critical challenge: 71% of companies admit their compliance programs fall short, and 54% still rely on manual processes that introduce risk. Safeguarding patient data is non-negotiable in today’s digital world. We must implement systematic approaches to manage cms audit requirements. Control mapping provides a well-laid-out framework to manage cms audit protocols in cloud environments of all types, especially for medicare advantage cms audit scenarios. This piece explores how to implement cms program audit protocols that work, streamline your cms audit checklist, and guide you through the cms audit process. We’ll cover core CMS audit requirements and implementation strategies. We’ll also discuss continuous compliance management to protect consumer data in cloud infrastructures. Understanding CMS Audit Control Mapping in Cloud Environments What is CMS Audit Control Mapping Control mapping refers to the process of implementing a control set that satisfies one framework’s requirements and then arranging that control set to meet another framework’s requirements. Within CMS environments, this means establishing controls that fulfill CMS ARS (Applicable Risk-Based Standards) requirements while mapping them to other regulatory frameworks like NIST SP 800-53 at the same time. CMS has already given guidance for most control areas and requires a comprehensive approach that addresses specific security challenges in cloud computing environments. The goal centers on identifying common controls that fulfill mapped requirements across multiple frameworks. Organizations can use these results as evidence of adherence across multiple frameworks because we only need to implement and test common controls once to verify their effectiveness. This approach reduces the time and resources spent creating independent control sets, gathering similar evidence, and performing redundant tests for multiple cms audit protocols. The Shared Responsibility Model in Cloud Security Security responsibilities in cloud environments split between the Cloud Service Provider (CSP) and the customer. Over the next three years, at least 95% of cloud security failures will stem from customer mistakes, according to predictions. This statistic underscores why understanding your portion of the shared responsibility model matters. The division of responsibilities varies based on the cloud service model you operate in. You manage virtual machines, operating systems, and applications for IaaS deployments. PaaS requires you to deploy applications without managing VMs or operating systems, while SaaS involves using ready-made applications where the provider handles most infrastructure components. Whatever service model you select, protection of your organization’s data always remains your responsibility. You always retain responsibility for data classification, endpoints, user accounts, and access management. Why Control Mapping is Critical for Consumer Data Protection Control mapping helps you learn about building your compliance roadmap by identifying overlaps and gaps across frameworks. Organizations can therefore achieve compliance with multiple cms audit requirements faster while avoiding duplicate work. Mapping controls boosts risk management efforts by identifying priority areas that compliance alone might not address. Organizations waste resources performing redundant activities for multiple cms program audit protocols without proper control mapping. The manual nature of unmapped controls creates inconsistencies and errors when relying on multiple spreadsheets and tools. Implementing systematic control mapping becomes vital for protecting consumer data in cloud environments where ambiguity about security responsibilities can lead to risk exposure. Core Components of CMS Audit Frameworks CMS Audit Requirements and Control Objectives The Medicare Parts C and D Oversight and Enforcement Group (MOEG) creates and administers the audit strategy to oversee programs under the Department of Audit Operations. MOEG conducts audits of participating Sponsoring organizations (Medicare Advantage Organizations, Prescription Drug Plans, and Section 1876 Cost Plans) to assess adherence to contractual and regulatory requirements. The cms program audit process structures into four distinct phases: Audit Engagement and Universe Submission, Audit Field Work, Audit Reporting, and Audit Validation and Close Up. Field work spans two weeks typically. CMS issues a preliminary draft report and reviews findings with the Sponsoring organization. NIST SP 800-53 Integration in CMS Programs NIST SP 800-53 is the foundation of CMS security policies and procedures, though CMS has tailored NIST guidance to apply within the agency. This publication provides a catalog of security and privacy controls to protect organizational operations from a variety of threats including hostile attacks, human errors, natural disasters, and foreign intelligence entities. The controls organize into 20 control families covering Access Control, Awareness and Training, Audit and Accountability, Risk Assessment, and System and Information Integrity. CMS Acceptable Risk Safeguards (ARS) derives from these NIST control baselines. The ARC-AMPE Framework Structure ARC-AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities) represents the next iteration of security and privacy standards. It incorporates updates to federal laws, agency regulations, and NIST standards. The framework consists of two volumes: Volume I provides guidance on scope and governance, while Volume II offers an Excel-based System Security and Privacy Plan template that establishes minimum-level security and privacy controls. The minimum control baseline requires 402 controls for ACA Administering Entities and 308 controls for Direct Enrollment Entities. Mapping Controls Across Multiple Compliance Standards Organizations managing multiple compliance frameworks can identify where controls overlap. This allows them to implement solutions once that satisfy multiple requirements. Control mapping makes it possible for businesses to reduce redundancy and focus on integrated compliance strategies when dealing with frameworks like GDPR, HIPAA, or PCI DSS. Automated mapping tools can generate mappings to every control in your compliance program and satisfy requirements across SOC 2, ISO 27001, and HIPAA at once. Implementing Control Mapping for Consumer Data Security Defining Scope and Applicable CMS Audit Protocols Organizations receive an engagement letter via the Health Plan Management System that identifies audit scope, timelines and data submission requirements. You must submit all requested universes within 15 business days of the engagement letter date. Follow instructions in the Audit Submission Checklist and respective Program Audit Data Request documents. The review period for universe files depends on your total enrollment, though CMS reserves the right to expand this period to ensure sufficient universe size. Security Controls and Evidence Collection in One Place A central log collection system provides specialized investigator accounts with unified access to cross-service logs. This
CMS EDE Documentation Kit: What You Need Before Your Next Audit Submission
CMS EDE audit submissions for Year 9 are open now, with the submission window closing July 1, 2026 at 3:00 AM ET. If you haven’t submitted yet, time is critical, entities that submit later in the window have fewer opportunities to correct completeness deficiencies before the deadline closes. The end-to-end review process can take a year or more, and resubmissions are common, making every remaining week count. The Classic Direct Enrollment pathway ended October 31, 2025. Enhanced Direct Enrollment is now the only permitted pathway for all entities. Navigating CMS audit protocols requires meticulous documentation across business requirements, privacy controls, and operational standards. We’ve compiled this detailed documentation kit to help CMS EDE partners assess their current submission status and close any remaining gaps before the July 1 deadline. CMS EDE Audit Submission Requirements for 2026 April 1 to July 1 Submission Window Timeline CMS conducts completeness reviews on all prospective primary EDE entity and prospective phase change EDE entity audits submitted within the April 1, 2026 to July 1, 2026 at 3:00 AM ET window. Your opportunities to correct completeness deficiencies depend, in part, on the time you submit your audit in the submission window. Early submissions allow more resubmission cycles before the window closes. CMS will not review audits until the submission window begins. You must submit a complete audit that CMS designates as complete before the deadline to advance to the next review phase. There is no guarantee that every prospective primary EDE entity or prospective phase change EDE entity that submits a complete audit within the submission window will receive approval prior to the PY 2027 OEP or during the 2026 calendar year. Primary vs Upstream Entity Documentation Differences Primary EDE entities must hire independent auditors to perform business requirements and privacy and security audits. You will identify your selected auditors in both the EDE Business Agreement and the Interconnection Security Agreement. Primary entities maintain oversight of upstream EDE entities and downstream agent and broker users of the approved EDE environment. Upstream EDE entities employ a primary EDE entity’s platform with customized branding and must maintain a legal, documented relationship with a primary EDE entity through a signed written agreement. New upstream EDE entities or existing upstream entities adding new functionality should work with their primary EDE entity to notify CMS of the proposed arrangement and submit operational and oversight documentation for review. Phase 1, 2, and 3 Audit Package Components Prospective phase change EDE entities submit audits to change end-state eligibility application phases during the same April to July window. The applicable program requirements for prospective phase change entities are listed in Exhibit 11 (Business Audit Phase Change Requirements) of the Guidelines. If you continue to seek approval for the phase indicated in your original audit submission without adding new functionality or systems, you may use a previously submitted complete business requirements audit. ISA and Business Agreement Submission Deadlines For primary EDE entities, CMS countersigns the EDE Business Agreement after reviewing and approving both your business requirements audit and annual privacy and security audit. Approved primary EDE entities must submit the ISA for the upcoming open enrollment period by the last business day of June as part of the annual ISCM documentation submission. The ISA contains Appendices that must be completed in full to consider for approval. Business Requirements Audit Documentation Kit Independent Auditor Selection and Qualification Standards You must hire independent third-party auditors to confirm compliance with program requirements. CMS thinks about auditors as downstream and delegated entities and makes you responsible for their performance and compliance. Business requirements audits need key auditor personnel to possess relevant certifications: Certified Internal Auditor (CIA), Certification in Risk Management Assurance (CRMA), Certified Information Systems Auditor (CISA), or Certified Government Auditing Professional (CGAP). You can select one auditor to handle both business and privacy audits or hire separate auditors to handle each component. API Functional Integration Testing Toolkit The API Functional Integration Toolkit verifies basic functional integration with EDE application programming interfaces. Your auditor must complete each test case on their own or work with you to verify proper functionality. The toolkit has nine data sets, with test data provided in the “EDE End-to-End Test Data” zip file. You must submit correct results for each test case, complete headers and bodies for API requests and responses, and raw, unmodified JSON and XML files that demonstrate successful OKTA integration. Eligibility Results and Application UI Toolkits Your auditor must provide screenshots of the entire application flow for each test case to verify eligibility results, along with correct eligibility results and eligibility determination notices. The Application UI Toolkit requires a clear assessment of Spanish-language applications when applicable. These toolkits must demonstrate complete field-level validation requirements consistent with FFE Application UI Principles. Communications Toolkit and Section 508 Compliance Evidence Your communications toolkit must have screenshots that demonstrate compliance in both English and Spanish where applicable. More, your eligibility application UI must meet Section 508 requirements under the Rehabilitation Act of 1973, as amended (29 U.S.C. § 749(d)). Your auditor confirms compliance with these accessibility standards. Risk Assessment Documentation and Compliance Findings CMS will not accept incomplete audits. Risks identified during the audit must be documented and explained, even if alleviated later. Your auditor must complete all yellow-shaded compliance findings columns in each toolkit and show compliance status, risk levels, mitigation strategies, and estimated resolution dates. Privacy and Security Audit Documentation Package Privacy and security audits are the second critical component of your CMS EDE submission package. Existing EDE entities that submit privacy and security audits must adhere to continuous monitoring reporting requirements in the ISCM Strategy Guide, which has completion of an annual assessment of security and privacy controls by an auditor. Primary EDE entities and hybrid non-issuer upstream EDE entities that are web-brokers may submit one ISCM audit covering both web-broker and EDE privacy and security continuous monitoring requirements. NIST 800-53 Controls Assessment (294 Controls) NIST SP 800-53 Rev 5 contains over 1,000 controls hosted in 20 control families. These
How to Align Your Internal Audit with ORR Scope for CMS Audit Readiness
CMS audit expectations have changed fundamentally with the agency’s aggressive approach to expand annual audits from 60 Medicare Advantage plans to over 550 plans nationwide. CMS now expects continuous compliance, not reactive preparation. Many health plans enter audits unprepared because their internal audits fail to line up with ORR (Operational Readiness Review) scope. Then the same compliance gaps surface year after year: missing CAP documentation and inconsistent universes with unclear ownership. This piece will show you how to line up your internal audit processes with ORR protocols to meet CMS program audit requirements, streamline your Medicare Advantage CMS audit preparation and build year-round readiness into your operations. What ORR Scope Means for Your CMS Audit Preparation Defining ORR in the Context of Medicare Advantage Audits ORR refers to the operational readiness framework CMS uses to verify that organizations can execute compliance requirements under real-life conditions. Traditional compliance checks are different. ORR evaluates whether your systems, workflows and governance structures function consistently at scale. CMS applies this lens across Medicare Advantage program audits to determine if plans have effective operational processes in place to meet regulatory requirements and protect beneficiaries. The framework originated from CMS requirements for entities integrating with federal platforms. Prospective organizations must demonstrate readiness through evidence that systems are prepared for production, outcomes are achievable and metrics can be generated as approved. Medicare Advantage organizations face the same operational validation during CMS program audits. How ORR Scope Is Different from General Compliance Reviews General compliance reviews verify that documentation exists. ORR scope examines whether processes work. CMS now evaluates operational effectiveness through statistical sampling across populations of all sizes, multi-universe validation and timeliness pattern analysis. Auditors cross-check what you’ve written against actual outcomes, timelines and data behavior across systems. Clean documentation no longer protects organizations from findings rooted in operational execution. CMS states that program audits determine whether organizations have effective systems and controls, not whether they can explain their processes. Plans relying on documentation to compensate for fragile workflows find that fragility during sampling. ORR Requirements for Part C and Part D Programs Each Medicare Advantage organization must maintain effective procedures to develop, compile, evaluate and report information to CMS in required timeframes. Part D sponsors face similar obligations. Both programs require annual retrospective data validation conducted by independent external contractors to ensure reporting accuracy. Organizations must participate in validation audits during the year following the contract year. Data validation for calendar year 2022 occurred in 2023, for example. You cannot use internal staff to validate this and must acquire external resources to ensure independence. Why Internal Audits Fail Without ORR Alignment Internal audits fail when they become checkbox exercises disconnected from actual risk. Audit programs focused on procedures and timelines miss what matters: whether processes handle volume spikes, staff turnover and delegated involvement consistently. Staff gets pulled in multiple directions when audits follow calendars instead of risk. Findings don’t connect to broader system signals, and internal familiarity softens questioning. You pass internal audits while leaving systemic gaps unaddressed without ORR alignment. These gaps surface during CMS audits as recurring CAPA issues, incomplete supplier qualifications and post-market surveillance deficiencies. Aligning Your Internal Audit Sampling with ORR Protocols Match Sampling Size to ORR Universe Requirements Sampling requirements mirror CMS Web Interface protocols. Organizations must report on a minimum of 248 consecutively ranked and confirmed Medicare patients for each measure, whatever the plan size. Report on all available sampled patients if your eligible patient pool falls below 248. CMS prepopulates samples with an oversample of 616 patients for nine measures and 750 patients for PREV-13. Your internal audit sampling must copy these thresholds and identify data gaps before CMS requests universes. Select Audit Periods That Reflect CMS Audit Process CMS uses administrative claims data from January 1 through October 31 of the performance year and determines patient eligibility. Your internal audits must analyze the same timeframe to verify that exclusion criteria match CMS standards. Patients excluded from quality measurement include those with fewer than two primary care services, part-year FFS eligibility, hospice enrollment, deceased status or non-U.S. residence. Document Sampling Methodology Using ORR Standards Sampling documentation must identify the population, areas of focus, sample size, selection rationale and results. Document the rationale in workpapers when reducing sample size below thresholds. Statistical sampling allows inference about entire populations, whereas judgmental sampling informs conclusions without population-level extrapolation. CMS expects documentation sufficient for independent third-party review. Verify Sample Accuracy Against CMS Compliance Measures Validation confirms that reported quality data matches source records. Almost 99 percent of hospitals passed validation reviews, with CMS reducing payments for the six that failed. Organizations cannot skip patients without providing valid exclusion reasons defined in measure specifications. Handle Edge Cases and Exceptions Per ORR Guidelines Edge cases represent atypical boundary conditions that cause unexpected program behavior. Define expected input ranges and implement validation checks. You must handle edge cases before functional logic executes to prevent downstream errors. This approach establishes logic to handle special conditions appropriately. Synchronizing Evidence Collection with ORR Documentation Standards Identify Required Evidence Types Under ORR Scope Organizations must produce specific documentation to support sampled cases within tight timeframes during CMS program audit field work. Required evidence has medical records, decision history, member communications, clinical reviewer documentation, and timestamps that prove process compliance. CMS estimates program audits require 300-346 hours on average. Prepping case files consumes disproportionate time since teams must pull documentation from multiple systems under pressure. Organizations should identify every evidence type applicable to their audit scope and map where each document type resides in current systems. Structure Evidence Files to Match CMS Audit Requirements CMS conducts universe integrity testing within five business days of receipt to verify data accuracy. Organizations must demonstrate through live system reviews that universe data points match source documentation. Structure evidence files to enable rapid validation. Maintain clear naming conventions, consistent folder hierarchies, and direct links between universe records and supporting documents. Screenshot capabilities should be prepared in advance since CMS may request additional documentation during
CMS EDE Vendor Oversight: What You Need to Know About Downstream Partner Requirements
Managing CMS EDE vendor partnerships requires careful oversight of downstream entities. You need this to ensure compliance throughout your ecosystem. Enhanced Direct Enrollment pathways are available in 36 states that use the Federally Facilitated Exchange or State-based Exchange on the Federal Platform. Using an EDE vendor allows your health plan to control the customer experience and ensures your plans are the only ones prospective members see. But this control comes with most important compliance responsibilities. You must understand how CMS classifies cms ede partners and understand cms ede audit requirements. You also need to ensure cms approved ede partners meet rigorous standards. This piece breaks down the cms ede assessment process and ongoing monitoring obligations. It covers documentation requirements you need to maintain regulatory compliance. Defining Downstream and Upstream EDE Partner Relationships How CMS Classifies EDE Entity Types CMS recognizes three distinct partnership models for Enhanced Direct Enrollment participation. Primary EDE entities develop and host their own platforms. They build the technical infrastructure from scratch. Upstream EDE entities use an approved primary entity’s platform, typically with customized branding for their organization. Downstream agents and brokers use an approved primary or upstream entity’s environment without keeping separate CMS agreements. The classification you select determines your technical obligations and audit burden. Primary entities must integrate with more than 20 APIs that help with eligibility, enrollment and post-enrollment experiences. These entities undergo extensive third-party audits of both their application structure and privacy/security framework. Primary vs Upstream Entity Responsibilities Primary EDE entities bear the heaviest compliance load. Building an EDE platform requires developing systems that communicate consumer information to the Marketplace and receive data back from CMS through the API suite. The Exchange retains responsibility for eligibility determinations and communicates those decisions to the EDE entity via APIs for display on your website. Upstream entities face a different calculus. You generally avoid application and privacy/security audits if you make only minor branding changes to a primary entity’s platform. But any deviation beyond minor branding triggers additional scrutiny. Hybrid entities that add functionality must submit to audit requirements similar to primary entities. When Third-Party Agents Become Downstream Partners CMS distinguishes between white-label users and hybrid arrangements based on functional changes. White-label users add only logos or names to a primary entity’s environment. These users don’t need unique partner IDs, separate EDE Business Agreements or privacy audits. Hybrid arrangements emerge when you transfer consumer data outside the primary entity’s audited boundaries. Any arrangement that sends consumers or transmits their data collected for application purposes outside the primary entity’s approved system boundaries constitutes a hybrid relationship. Hybrid non-issuer upstream entities must maintain unique partner IDs, sign EDE Business Agreements and complete privacy audits for added functionality. Downstream third-party agents and brokers operate differently. They access approved EDE environments without signing separate agreements or receiving unique partner IDs for API transactions. The primary entity remains responsible for ensuring downstream compliance with all EDE Agreement terms. Compliance Requirements for CMS EDE Partners Business Agreement and ISA Requirements Prospective primary EDE entities must sign two agreements with CMS before they can access the EDE pathway. The EDE Business Agreement sets forth consumer communication and operational requirements. The Interconnection Security Agreement (ISA) establishes privacy and security requirements your organization must maintain. CMS countersigns the ISA only after it reviews and approves your business requirements audit and annual privacy and security audit. Appendix B of the ISA requires detailed documentation of all upstream entity arrangements, web-broker relationships and downstream agent configurations with proposed functionality or systems. Partner ID Assignment and Usage Rules White-label issuer upstream entities submit the DE Entity Documentation Package and EDE Business Agreement. They retain a unique Partner ID. Hybrid issuer upstream entities follow the same pattern. Downstream third-party agents and brokers neither sign agreements nor receive Partner IDs for EDE API transactions. Privacy and Security Standards for Hybrid Entities Independent third-party auditors conduct extensive security and privacy reviews before approval. CMS reviews audit results to ensure compliance with nearly 300 CMS security and privacy standards. Hybrid non-issuer upstream entities must retain auditors to conduct privacy and security audits relevant to additional functionalities they add to the primary entity’s approved environment. Code of Conduct and Exclusion Screening Web-brokers must verify that agents and brokers using their EDE environment maintain appropriate state licensure. They must also confirm these partners have completed Exchange training and registration. This oversight obligation extends to ensuring downstream partners sign required agreements pursuant to regulatory requirements. API Integration and Technical Requirements Primary entities integrate with more than 20 APIs that facilitate the eligibility, enrollment and post-enrollment experience. Testing environments must represent production EDE environments and integration with the EDE pathway. This includes functional use of all EDE APIs. CMS conducts ongoing oversight of each entity’s end-user experience in both production and testing environments. CMS Approved EDE Partners Selection and Vetting Process Evaluating Primary EDE Entity Capabilities The right cms ede partners start with a verified technical foundation. Approved EDE partners must pass a CMS review process before receiving approval. Primary entities build EDE environments and submit two-part audits within CMS-established submission windows. Each prospective primary entity involves independent auditors to perform these assessments and certify that websites and operations comply with applicable program requirements. Business requirements and privacy/security structures fall under the audit scope. CMS reviews audit results to ensure compliance with nearly 300 CMS security and privacy standards. Business logic audits verify that a partner’s system will deliver consumer information to the Exchange for eligibility determinations accurately to demonstrate platform accuracy. The assessment process involves multiple complex requirements. Experienced entities reduce implementation risk. Book a Readiness Call to discuss your cms ede assessment strategy with specialists who understand the approval timeline. Legal Agreement Verification Between Entities Prospective entities identify selected auditors in both the EDE Business Agreement and ISA during the approval process. An upstream entity that uses another entity’s approved EDE pathway must indicate this arrangement in its EDE Agreement and ISA. The entity must be prepared to submit copies of business requirements
CMS EDE Readiness: Building Controls and Evidence for Successful Audits
CMS EDE audits need rigorous preparation, complete documentation, and precise control implementation to achieve approval. Organizations face major challenges working through the complex requirements that span privacy controls, security frameworks, and operational protocols. Failing to meet these standards can result in audit delays, resubmissions, or approval denials that affect your marketplace participation. This guide will help you build audit-ready systems. You’ll learn how to establish privacy and security controls, implement business requirements, and assemble evidence packages. The guide covers CMS audit protocols and program audit requirements. It also provides strategies to address common findings and maintain ongoing compliance as you work through the CMS EDE assessment timeline. Understanding CMS EDE Audit Requirements and Program Protocols Prospective entities pursuing the EDE pathway face distinct audit requirements based on their operational model. Primary EDE entities that build their own platform must undergo third-party audits of both their application and privacy/security structure. Upstream EDE entities that use a primary EDE entity’s platform with only minor branding changes are not subject to audits of their application and privacy/security structure. But if an upstream entity wishes to make deviations beyond minor branding from an approved primary platform, that entity may also face audit requirements. Primary vs. Upstream EDE Entity Audit Scope Primary EDE entities provide the full application, enrollment, and post-enrollment support experience on their websites and must implement the complete EDE API suite of required services, whatever their chosen application phase. These entities bear full responsibility for developing two distinct audit packages that demonstrate compliance with all program requirements. Upstream entities using an approved EDE pathway from another entity must indicate this arrangement in their EDE Agreement and ISA. They must be prepared to submit copies of the business requirements audit package, privacy and security audit package, and documentation of the arrangement upon CMS request. An upstream entity that adds functionality or systems beyond the approved pathway must conduct and resubmit the applicable part of the operational readiness review with findings for any added functionality. Business Requirements Audit vs. Privacy and Security Audit Each prospective primary EDE entity must hire one or more independent auditors to perform two separate audits. The Business Requirements Audit certifies that the entity’s website and operations comply with applicable program requirements listed in the Business Requirements exhibit. Auditors conducting this audit must complete the Business Requirements Audit Report Template and applicable toolkits provided by CMS. These include API Functional Integration Testing, Eligibility Results, Application User Interface and Communications toolkits. The Privacy and Security Audit will give compliance with privacy and security requirements through a Security and Privacy Control Assessment that produces a Security Assessment Report (SAR). This audit certifies that the entity has implemented processes sufficient to meet privacy and security requirements set forth in the ISA and applicable regulations. Auditors may determine that an entity does not meet one or more requirements. The entity must then create a Plan of Action and Milestones (POA&M) to resolve the deficiency. Annual Audit Submission Window Timeline The audit submission window for prospective primary EDE entities and prospective phase change EDE entities runs from April 1 to July 1 at 3:00 AM ET each year. CMS will not review audit submissions received after July 1 at 3:00 AM ET, whether they are submissions or resubmissions to address completeness findings. This timeline applies to all future calendar years unless CMS indicates otherwise. An EDE environment may take up to or more than a year to develop and audit. The approval process starts once an entity submits a complete audit. It involves multiple resubmissions and may take many months after an audit submission has been deemed complete. The process can extend up to a year or more depending on the selected end-state phase, build quality, audit documentation quality and timeliness of resubmissions. CMS’s experience with prior audits shows that prospective EDE entities submitting complete audits later in the submission window (mid-to-late May through June) have a lower probability of being approved to go live before the Open Enrollment Period. This depends on submission quality and phase selection. CMS Program Audit Protocols and Review Process CMS conducts completeness reviews on all prospective primary EDE entity and prospective phase change EDE entity audits submitted within the applicable submission window. The entity must submit a complete audit and CMS must designate the audit submission as complete before the deadline for the end of the audit submission window. Only then can the entity advance to the next phase of the review process. An entity’s opportunities to correct completeness deficiencies depends, in part, on the timing of its audit submission in the audit submission window. CMS will not accept incomplete audits and will require that incomplete audits be resubmitted in their entirety. CMS may request revisions and resubmissions to address non-compliant requirements during its compliance review of the audit submission. The prospective EDE entity may be required to continue working with its auditor after audit submission. If resubmission requires another audit of requirements in a template or toolkit, the entity is expected to work with its auditor to confirm that resubmitted requirements are compliant. Building Privacy and Security Controls Framework Privacy and security controls are the foundations of your CMS EDE audit readiness. You need detailed documentation, rigorous testing protocols and ongoing monitoring activities to implement these controls and demonstrate your commitment to protecting consumer data. NEE SSPP Documentation Requirements Web-brokers must implement the privacy and security controls set forth in the NEE SSPP consistent with requirements in the Web-broker Agreement. The NEE SSPP has complete security and privacy controls and implementation standards for all aspects of the EDE program. This documentation describes the annual assessment that entities must conduct. It covers the assessment methodology and the tests and analysis to be performed on an annual basis. Your SSPP provides an accurate, detailed description of your system itself, its security requirements and the controls in place to protect the system. So this living collection of information must be updated with any changes to the system, especially when a
CMS EDE UAT Testing: ORR Requirements, API Validation, and Audit Readiness (2026)
UAT testing for CMS Enhanced Direct Enrollment (EDE) pathways is not optional. It’s a critical gateway to compliance. Primary EDE entities must undergo a third-party audit of their EDE application and privacy and security structure, coupled with CMS approval and ongoing monitoring. 36 states rely on the Federally Facilitated Exchange or State-based Exchange on the Federal Platform. The stakes for user acceptance testing are high. We’ll explore the technical requirements for CMS EDE implementation. This piece covers API integration best practices and audit preparation. It also addresses security controls and compliance submission timelines. You’ll find useful information on staging environment configuration, test case execution, and defect resolution cycles needed for successful EDE certification. UAT Testing Requirements for CMS EDE Implementation CMS EDE Platform Prerequisites and Scope Definition The CMS Expedited Lifecycle (XLC) process governs the Operational Readiness Review (ORR) for CMS EDE pathways. Each Direct Enrollment entity that pursues EDE participation must submit an ORR composed of two separate audit packages: a business requirements audit and a privacy and security audit. Prospective EDE entities must establish a testing environment that represents their production environment and the EDE pathway accurately before they initiate UAT testing. This includes functional use of all EDE APIs. Strict boundaries face data collection activities. A DE entity must perform data collection only through its approved EDE pathway. The entity cannot collect consumer eligibility application information on any website or application other than approved websites identified in the entity’s EDE pathway application process submitted to CMS. User access credentials must secure testing environments used for CMS oversight. Primary vs Upstream EDE Entity Testing Requirements Primary EDE entities build the EDE platform and integrate with a suite of more than 20 APIs that aid eligibility, enrollment and post-enrollment experiences. Third-party audits of their application and privacy/security structure are what these entities undergo. Upstream EDE entities use a primary entity’s platform with customized branding by contrast. They face fewer audit requirements when they implement only minor branding changes. Audits become mandatory for hybrid issuer upstream EDE entities and hybrid non-issuer upstream EDE entities that add functionality beyond branding. The primary EDE entity’s ISA Appendix B must document all upstream relationships. Each upstream maintains a unique Partner ID and signs the EDE Business Agreement. Business Requirements Audit Preparation The Business Requirements Audit Report Template along with applicable toolkits provided by CMS must be completed by auditors. CMS begins its review only after the completed package requires full documentation. High-risk issues that may affect a consumer’s eligibility determination, enrollment disposition or legal attestation must be resolved before final approval is received. CMS encourages entities to review completeness requirements really well. This helps avoid audit rejection during the submission window. Privacy and Security Audit Controls (NIST 800-53) EDE entities must implement security and privacy controls that protect the confidentiality, integrity and availability of information collected, used, disclosed and retained, as CMS defines in the ISA. A Security and Privacy Control Assessment (SCA) is what auditors conduct. They produce a SAR that certifies processes meet privacy and security requirements set forth in the ISA and applicable regulations. NIST Special Publication 800-53 Revision 5 provides the framework for these controls. It offers a catalog of security and privacy controls that address requirements from mission needs, laws, executive orders and regulations. Technical Integration and API Testing Best Practices EDE API Integration Testing Framework Primary EDE entities must integrate with more than 20 APIs that make the eligibility, enrollment, and post-enrollment experience easier. The Exchange communicates eligibility determinations to the EDE entity via these APIs, which the entity displays on its website. The required API suite has Store ID Proofing, Person Search, Create App, Create App from Prior Year App, Store Permission, Revoke Permission, Get App, Add Member, Remove Member, Update App, Delete App, Submit App, Get Data Matching Issue (DMI), Get Special Enrollment Period Verification Issue (SVI), Metadata Search, Notice Retrieval, Submit Enrollment, Document Upload, System and State Reference Data, Get Enrollment, Payment Redirect, Update Policy, and Events Based Processing for Year 5 implementations. EDE entities must complete development and API integration before they initiate audits. The API suite provides data and tools to manage customer relationships. This means updating applications and enrollments when needed and helping consumers with post-enrollment activities such as remedying open Data Matching Issues (DMIs), Special Enrollment Period Verification Issues (SVIs), and payment issues. Eligibility Results Toolkit Validation The Eligibility Results Toolkit is a core component of business requirements audits. Entities should not begin business requirements audits until CMS releases new baseline toolkit versions in the first quarter, around mid to late February. Communications Toolkit Testing Requirements The Communications Toolkit establishes minimum communications that EDE entities must provide. Auditors must provide screenshots that demonstrate compliance with these communication standards. Partner Test Case Suite Execution We recommend testing environments using the supplemental EDE Partner Test Case Suite strongly. This is in addition to all applicable required test cases contained in the toolkits. Applications should be complete and functional by February. This allows developers time to make last-minute CMS-requested changes and complete audits. SAML Response and SOAP Web Services Testing SOAP APIs use header-based tokens frequently. These tokens include UsernameToken, SAML assertions, or OAuth-style tokens. SAML assertion extraction and transmission through SOAP web services requires specific implementation patterns to maintain security. UAT Environment Setup and Testing Workflows Staging Environment Configuration for EDE CMS requires each prospective and approved EDE entity to maintain a testing environment that represents its production environment and integration with the EDE pathway accurately, including functional use of all EDE APIs. Testing environments used for CMS oversight must be secured with user access credentials. Georgia Access refers to an entity as an EDE Partner applicant until certification is granted after the entity’s application has been accepted. Test Data Management and Consumer Application Scenarios Complete test cases identified by Georgia Access and provide consistent eligibility determination scenarios covered by the EDE Partner applicant’s certified EDE phase specified in the Georgia Access API Testing Guide. Track agent and consumer interactions within