Medicaid Enterprise Systems (MES) Modernization

MES Modernization Transformation Objectives and Outcomes

Medicaid has started a multi-faceted modernization initiative to transform systems and processes critical to achieving the Department's goal of improving the health of New Yorkers. This will involve transitioning from several legacy technologies to more modern systems capable of scaling and responding to the evolving needs of the Medicaid program.

Pyramid chart with 3 levels, top: operations, center: execution, bottom: foundation

MES transformation objectives are anchored to:

  • Our Architecture and Standards
    • Cloud-Native and SaaS Adoption - Transition to resilient, highly available cloud infrastructure and platforms (i.e., SaaS, PaaS, and Infrastructure as a Service [IaaS]) to support dynamic workload management, including automated scaling, robust disaster recovery, and deep observability across the MES
    • Modular and API-Driven Solutions - Develop independently deployable, domain-driven modules and microservices using modern, well-defined data exchange methods (e.g., APIs and connectors) to enable interoperability across the MES
    • Alignment to OHIP Standards - Require adherence to the OHIP Standards, including compliance with State and federal standards and industry best practices
  • How We Build and Buy
    • OHIP Preferred Tools - Require use of OHIP Preferred Operational Tools to support enterprise operations, eliminate proprietary technology, and avoid procurement of duplicative capabilities
    • Team Practices (Agile, DevSecOps, Human-Centered Design [HCD]) - Apply agile and iterative design and development practices, HCD, DevSecOps, automated testing, and telemetry to support modern development and continuous improvement
    • Platforms and Tooling (Low-Code, Artificial Intelligence [AI], CI/CD) - Accelerate value delivery through AI-enabled, model-driven solution engineering using low-code and no-code platforms, rules and workflow engines, and reusable shared services, delivered through secure, automated CI/CD pipelines in State-controlled tenants
  • How We Organize and Deliver
    • Enterprise Shared Services (ESS) - Implement centralized ESS across the MES to enable reuse and reduce duplication
    • Alignment of Business Services to Technology - Design and operate technology to support Medicaid business services (e.g., member enrollment, provider onboarding, prior authorization), ensuring clear ownership of modular components, interoperability, data, and service levels
    • Modernized Procurement and Contracting - Implement flexible, modular procurement strategies and outcome-based contracts to accelerate delivery, support innovation, and align vendor incentives with Department goals

By pursuing these objectives, the Medicaid program expects to achieve:

  • Increased Ownership - Internal technical capabilities are strengthened, and OHIP increases ownership of licenses, code, configurations, documentation, and data, while improving vendor transparency and knowledge transfer to reduce reliance on vendors.
  • Continuous Modernization - Medicaid solutions remain modern and secure, readily incorporating emerging innovations without requiring disruptive system overhauls, and enabling the Department to continuously adopt best-in-class technologies as they evolve.
  • Improved Medicaid Member and Provider Experience - Medicaid members experience seamless and timely access to benefits, providers face minimal administrative burden, and State staff operate more efficiently, supported by high-quality, integrated data that enables proactive, evidence-based decision-making to improve health outcomes.
  • Mandate-Readiness - The Department adapts to State and federal mandates and other business needs with reduced operational lag, fewer service disruptions, and minimized solution-related backlogs.
  • Lower Costs - Implementation and vendor costs are reduced through the use of AI and modern automation to streamline development and integration of new solutions, reducing manual engineering effort and resource requirements while optimizing the Department's IT budget and maximizing return on investment (ROI).
  • Faster Delivery - Medicaid solutions, program features, and vendor services are delivered and updated in weeks or months rather than years, accelerating the Department's ability to deploy critical and innovative capabilities.

MES Standards Domains

The Medicaid Enterprise Systems (MES) Standards establish the mandatory technical, operational, and security requirements for New York State (NYS) to remain compliant with federal regulations under 42 CFR § 433.112, qualifying the state for enhanced Federal Financial Participation (FFP). They are broken down into five (5) domains.

5 domains: solution delivery; data and information management; infrastructure and operations; program and project management; security, privacy, and compliance

The 5 MES Standards Domains

Solution Delivery
  • Usability and Accessibility Standard
  • Requirements Management Standard
  • Policy and Business Rules Standard
  • Code Standard
  • Test Management Standard
  • Release Management Standard
  • Solution Development Life Cycle (SDLC) Standard
  • Business and Technical Architecture Standard
Domain Document
  • OHIP MES Standard
  • OHIP Baseline
Data and Information Management
  • Data Governance Standard
  • Data Architecture and Naming Standard
  • Database Design Standard
  • Data Conversion Standard
  • Data Lakehouse Architecture Standard
  • Content and Document Management Standard
Program and Project Management
  • Project Management Standard
  • Project Change Control Standard
  • Technical Change Control Standard
  • Contract Management Standard
Infrastructure and Operations
  • Information Technology Service Management (ITSM) Standard
  • Application Integration Standard
  • Infrastructure Management Standard
  • Log Management Standard
  • Cloud FinOps Standard
  • Ongoing Licensing and Support Standard
  • Preferred Operational Tools Standard
Security, Privacy, and Compliance
  • Security and Privacy Compliance Standard
Baseline Documents
  • Application Programming Interface Secure Development Baseline
  • Artificial Intelligence Security and Privacy Baseline

The standards establish a foundation for consistency, compatibility, and compliance with industry-required and best practices. The following domains are addressed:

Domain Description
Solution Delivery This domain defines the solution development life cycle (SDLC) for all MES solutions, including requirements management, code standards, policy and business rules implementation, test management, release management, and architectural modeling. It supports Waterfall, Agile, and various Hybrid delivery methodologies while integrating security, privacy, and architectural oversight for each phase of delivery.
Data and Information Management This domain manages data as a strategic enterprise asset, including naming conventions, database design, DC analytics, and data lakehouse architecture. It ensures compliance with federal regulations while enforcing interoperability standards, data quality controls, and enterprise to enterprise (E2E) data life cycle management across all OHIP systems.
Infrastructure and Operations This domain directs cloud infrastructure management, IT service management (ITSM), log management, operational tooling, software licensing, API gateway management, Fast Healthcare Interoperability Resources (FHIR) and EDI interoperability standards, and event-driven integration patterns across all MES environments. It emphasizes SaaS-first delivery, enforces financial transparency through Cloud FinOps practices, and ensures long-term system sustainability and compliance with CMS and NYS requirements.
Program and Project Management This domain provides oversight of project execution, change control, contract administration, and technical governance for all MES projects. It establishes enforceable standards for scope, schedule, budget, risk, and documentation management across the full Contract life cycle, aligned with CMS Streamlined Modular Certification (SMC), APDs, and enhanced Federal Financial Participation (FFP) requirements.
Security, Privacy, and Compliance This domain establishes and enforces adherence to OHIP's Security and Privacy Controls for all systems that create, process, transmit, or store OHIP data. It defines requirements for the System Security and Privacy Plan (SSPP) and a centralized compliance reference repository accessible to all internal and external stakeholders.

MES Standards Domain Documents