(a) FFP is available for expenditures under an MCO, PIHP, or PAHP contract only if the State meets the following conditions for providing enrollee encounter data to CMS:

(1) Enrollee encounter data reports must comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) security and privacy standards and be submitted in the format required by the Medicaid Statistical Information System or format required by any successor system to the Medicaid Statistical Information System.

(2) States must ensure that enrollee encounter data is validated for accuracy and completeness as required under §438.242 before submitting data to CMS. States must also validate that the data submitted to CMS is a complete and accurate representation of the information submitted to the State by the MCOs, PIHPs, and PAHPs.

(3) States must cooperate with CMS to fully comply with all encounter data reporting requirements of the Medicaid Statistical Information System or any successor system.

(b) CMS will assess a State's submission to determine if it complies with current criteria for accuracy and completeness.

(c) If, after being notified of compliance issues under paragraph (b) of this section the State is unable to make a data submission compliant, CMS will take appropriate steps to defer and/or disallow FFP on all or part of an MCO, PIHP, or PAHP contract in a manner based on the enrollee and specific service type of the noncompliant data. Any deferral and/or disallowance of FFP will be effectuated utilizing the processes specified in §§430.40 and 430.42 of this chapter.