The money is federal, the contract is state
Almost every large data contract at a state health agency is paid for with federal dollars that arrive with strings attached, and almost none of them are awarded the way a federal contract is awarded. There is no FAR. There is no contracting officer in the federal sense. There is a state procurement statute, a state purchasing office, a program office that wrote the requirement, and a federal agency sitting upstream deciding what share of the invoice it will reimburse. Vendors who treat these as ordinary state IT deals lose on mechanics they never saw. Vendors who read the funding first can usually tell, months before the solicitation posts, what the agency is allowed to buy and roughly what it will spend.
Two funding tracks dominate. The first is Medicaid, where the federal government reimburses a percentage of what the state spends and the percentage depends on what the spending is classified as. The second is public health, where CDC and other HHS operating divisions award cooperative agreements to health departments and the department then buys services with that money. The two tracks have different approval chains, different timelines, different security regimes, and different tolerance for a firm with no prior work in that state.
A third track matters more than its size suggests: state general fund appropriations. When a legislature funds something directly, the agency skips the federal approval chain and moves in weeks instead of quarters. Those buys are smaller, often under the state's competitive threshold, and they are the most realistic first contract in a new state.
Medicaid: the 90/10 and 75/25 match rules
Section 1903(a)(3) of the Social Security Act (42 U.S.C. 1396b(a)(3)) is the provision that shapes the entire Medicaid systems market. It authorizes an enhanced federal share of 90 percent for the design, development, installation or enhancement of mechanized claims processing and information retrieval systems approved by CMS, and 75 percent for the operation of those systems once they are running. The implementing regulations sit at 42 CFR Part 433, Subpart C, with the conditions for the enhanced match spelled out at 42 CFR 433.112 and 433.116.
Everything else the Medicaid agency spends on administration is matched at 50 percent under Section 1903(a)(7). That single distinction drives behavior. A $4 million analytics engagement that qualifies as design and development of an approved Medicaid Enterprise Systems module costs the state $400,000. The same $4 million bought as general administrative consulting costs the state $2 million. State budget staff know this arithmetic cold, and it explains why so many state health data requirements arrive shaped as system modules even when the underlying work is analysis.
CMS's 2015 final rule (CMS-2392-F, 80 FR 75817) made the enhanced match for eligibility and enrollment systems permanent and pushed the Medicaid Enterprise standards and conditions at 42 CFR 433.112(b) across that class of systems: modularity, industry standards, alignment with the Medicaid Information Technology Architecture, and outcomes reporting. CMS has since moved certification toward a streamlined, outcomes-based modular review. That is why a state which once bought one enormous replacement system now buys eight or twelve pieces from different vendors.
Where the federal share comes from
| Funding stream | Federal share | What it pays for |
|---|---|---|
| Medicaid systems DDI | 90% | Design, development, installation or enhancement of a CMS-approved Medicaid Enterprise module |
| Medicaid systems operations | 75% | Hosting, maintenance, help desk and ongoing operation of a certified module |
| Eligibility and enrollment systems | 90% / 75% | Same split, extended permanently to E&E systems by the 2015 CMS rule |
| General Medicaid administration | 50% | Studies, evaluations, staff augmentation and analytics not tied to an approved system |
| CDC cooperative agreements | 100% | Surveillance systems, registries, laboratory reporting, data modernization; no state match required |
| State general fund | 0% | Anything the federal rules will not cover, and anything the agency wants to move on quickly |
Match rates from 42 U.S.C. 1396b(a) and 42 CFR Part 433, Subpart C. Cooperative agreement terms vary by notice of funding opportunity.
The Advance Planning Document is the real gate
Before a state can claim the enhanced match, it has to get CMS approval through an Advance Planning Document. The rules live at 45 CFR Part 95, Subpart F. A Planning APD funds the analysis and the procurement itself. An Implementation APD covers the build, with a cost allocation showing how the expense is split across benefiting programs. An annual APD Update keeps the approval alive and reports actual spend against plan under 45 CFR 95.610.
45 CFR 95.611 sets out which acquisition documents need federal prior approval before the state can move. For any significant system procurement, CMS reads the RFP before it is published and the contract before it is signed. So the scope, the deliverable structure, the cost breakdown and often the evaluation criteria were negotiated with a federal reviewer months before the solicitation appeared. Approved APDs describe the module, timeline and budget in detail. Many states publish them; the rest are ordinarily obtainable by public records request. Reading one is the closest thing this market has to advance notice.
The federal government keeps a license to what you build
Under 45 CFR 95.617, the state holds ownership rights in software designed, developed or installed with federal financial participation, and the federal government reserves a royalty-free, nonexclusive and irrevocable license to reproduce, publish or otherwise use that software. If your commercial product is the deliverable, the line between your background intellectual property and the federally funded development work belongs in the proposal, not in a dispute two years later.
Public health money runs on a different track
State and territorial health departments get most of their data money through cooperative agreements rather than formula match. The largest recent example is CDC's Public Health Infrastructure Grant, which began distributing roughly $3.2 billion to 107 state, local and territorial health departments starting in late 2022, with workforce, foundational capabilities and data modernization as its three pillars. Alongside it, the Epidemiology and Laboratory Capacity cooperative agreement funds surveillance and laboratory information systems across roughly 64 jurisdictions, and the Public Health Emergency Preparedness program moves on the order of $700 million a year to 62 recipients.
Behind all of it is CDC's Data Modernization Initiative, which the American Rescue Plan Act of 2021 (P.L. 117-2) funded with $500 million for public health data surveillance and analytics infrastructure. That money is why electronic case reporting, syndromic surveillance, laboratory result exchange, immunization registries and vital records systems have all been rebuilt or re-procured recently.
Cooperative agreements require no state match, which removes the budget arithmetic that shapes Medicaid procurements. Period of performance replaces it. These funds expire, and a health department carrying unobligated balances late in a budget period moves fast, which produces a steady pattern of smaller task orders against existing vehicles in the final quarter.
Who actually decides
Federal rules require a single state agency to administer Medicaid under 42 CFR 431.10, and that agency cannot delegate its administrative discretion. In practice the decision spreads across five parties, and a bid can die at any one.
The program office. The Medicaid data or systems director, or the state epidemiologist and informatics bureau chief, writes the requirement and owns the outcome. This is who you want to be known to.
The state procurement office. Usually a Department of Administration, Department of General Services or a chief procurement officer. It controls solicitation format, protest process, responsiveness determinations and the contract template, and rarely cares about your technology.
The state CIO or IT oversight body. Most states route technology spending above a threshold through a central authority. Texas subjects major information resources projects to Quality Assurance Team review under Texas Government Code Chapter 2054; Virginia routes technology procurement through VITA. These bodies can delay a solicitation a full budget cycle.
The federal partner. CMS reviews the Medicaid APD and acquisition documents. For public health, the CDC project officer approves the work plan and budget the contract must fit inside.
The legislature. Appropriation language, and in some states a separate legislative review committee for large contracts, sets the ceiling and occasionally the schedule.
Contract sizes and terms to expect
Full Medicaid Management Information System replacements were once single awards worth hundreds of millions over a decade. Modular procurement broke that apart. Individual modules now commonly land between $5 million and $60 million across a five-to-ten-year term with options: pharmacy benefits, provider management, care management, third-party liability, data warehouse and analytics, financial services, and the integrator role that stitches them together.
Public health data contracts are smaller. Immunization registry modernization, electronic case reporting onboarding, syndromic surveillance analytics and vital records modernization typically run from $500,000 to $10 million. Discrete analytics work, dashboard development, data quality remediation and interoperability engineering frequently land between $150,000 and $2 million, and a meaningful share of that sits below the state's formal competitive threshold.
Term structure is consistent: a base of one to three years with several one-year renewal options, milestone payment, retainage of five to ten percent held until acceptance, service level credits during operations, and for Medicaid modules a payment milestone tied to CMS certification. Prompt payment statutes in most states set thirty to forty-five days. Insurance usually runs commercial general liability at $1 million per occurrence, professional liability at $1 million to $5 million, and cyber liability at $1 million to $5 million.
Registration: how a vendor becomes findable
There is no SAM.gov for states. Each runs its own vendor registration and solicitation portal: eVA in Virginia, MyFloridaMarketPlace and the Vendor Bid System in Florida, Cal eProcure in California, the Electronic State Business Daily in Texas, Team Georgia Marketplace, OhioBuys, BidBuy in Illinois, WEBS in Washington, SIGMA VSS in Michigan, and the New York State Contract Reporter. Registration is free or nearly free in most states and takes under an hour. Skipping it in a state you care about is unforced error.
Beyond the portal, four mechanisms actually determine whether a state agency can hand you work.
Prequalified pools and term schedules. Many states buy technology services only from vendors already on a state term schedule or in a prequalified pool. Texas DIR, Virginia VITA and North Carolina's statewide IT contracts are examples. Getting on one is a separate procurement with its own open windows, and it converts a nine-month RFP cycle into a two-week task order.
Cooperative purchasing. NASPO ValuePoint contracts, led by one state and adoptable by others, carry substantial technology volume. Separately, 40 U.S.C. 502(c) lets state and local governments buy information technology and security services from GSA Multiple Award Schedule holders through the Cooperative Purchasing Program. For a firm already registered federally, that is a real door.
Subcontracting to the incumbent. The systems integrator or module prime on a state Medicaid program is under constant pressure on specialized work: entity resolution, claims analytics, cloud migration, machine learning components, interoperability engineering. Medicaid primes including Deloitte, Gainwell, Conduent, Optum, Accenture and Acentra Health staff these engagements with subcontractors continuously.
Small-dollar delegated authority. Every state lets agencies buy below a threshold with limited or no competition, and the number varies widely. Work delivered that way is the most common origin of a first reference in a new state.
What actually blocks an out-of-state firm
Editorial weighting of how often each item is decisive, from public solicitations and state procurement statutes. Illustrative, not a measured statistic.
The barriers that are real, and the ones that are not
Residency preference gets more attention than it deserves. Roughly half the states apply an in-state bidder preference or a reciprocal preference that mirrors back whatever penalty the bidder's home state would impose. Alaska applies a five percent bidder preference under AS 36.30.170; Ohio's sits in Ohio Revised Code 125.09; New Mexico's resident business preference is in NMSA 13-1-21. These matter in a close price competition and almost never decide a technical evaluation. A local subcontractor usually neutralizes them.
Foreign qualification is administrative. Registering with the Secretary of State and appointing a registered agent generally costs a few hundred dollars plus an annual report. Most states require it before contract execution rather than before bidding. Read the instructions, because bidding when the solicitation requires registration at bid time is a responsiveness failure no clarification can cure.
Prior-experience requirements are the genuine barrier. A demand for three prior implementations of the same module type at state Medicaid agencies within five years cannot be argued around, and no federal full-and-open-competition standard sits above it. Under 2 CFR 200.317, a state procuring under a federal award follows the same policies it uses for its own funds, with only a short list of federal clauses carried through; the restrictive-competition prohibitions at 2 CFR 200.319 reach local governments, tribes and nonprofits rather than state agencies. Where the language is written that narrowly, the way in is as a subcontractor whose past performance the prime can cite. Federal Phase I awards carry no past-performance requirement at all, which is why the federal side is often the faster place to build the record a state will later ask to see.
Security and data rules you inherit with the contract
Health agency data contracts import obligations from several regimes at once, and the compliance posture is usually scored.
HIPAA. A vendor touching protected health information becomes a business associate and signs an agreement meeting 45 CFR 164.504(e), with the Security Rule at 45 CFR 164.302 through 164.318 governing safeguards. HHS proposed a substantial Security Rule update in January 2025 that would tighten multi-factor authentication and encryption expectations.
Federal tax information. Any system touching Medicaid eligibility likely touches IRS data, which brings Publication 1075 into scope with its NIST SP 800-53 baseline and inspection regime. Vendors underestimate this one constantly.
MARS-E. Eligibility and enrollment systems connected to the federal data services hub follow the Minimum Acceptable Risk Standards for Exchanges, also built on NIST SP 800-53.
42 CFR Part 2. Substance use disorder treatment records carry consent rules stricter than HIPAA. The 2024 final rule aligned much of Part 2 with HIPAA and set a compliance date of February 16, 2026.
State cloud authorization. Texas requires TX-RAMP certification for cloud services under Texas Government Code Chapter 2054, and similar programs appear in a growing number of state solicitations. An existing FedRAMP authorization frequently maps across.
The practical first move
The sequence below is what we run entering a new state health agency, assuming no prior relationship and no in-state office.
Entering a new state health agency
Go / no-go checklist
Run this before committing proposal hours. Two or more failures in the first four items usually means bidding as a subcontractor instead.
- Funding is identified and approved. An approved APD, an obligated cooperative agreement, or a line-item appropriation sits behind the requirement.
- Mandatory experience language is survivable. Prior-implementation counts and references can be met by our team or a named teaming partner.
- Registration clears the bid date. Portal registration, foreign qualification and pool membership are in place the day the bid is due, not promised later.
- The security regime is one we already hold. HIPAA business associate obligations, Publication 1075 scope, MARS-E, 42 CFR Part 2 and any state cloud authorization map to controls we operate today.
- Someone at the agency knows our name before release. An RFI response, a conference conversation or prior subcontract work is in the record.
- The evaluation is best value, not lowest price. Price-dominant scoring plus a residency preference is a losing combination for an out-of-state bidder.
- The data rights position is clear. Background intellectual property is separated from federally funded development, with 45 CFR 95.617 accounted for.
- Cash flow works. Milestone payment, retainage and a thirty-to-forty-five-day payment cycle sit inside our tolerance for the full base period.
Bottom line
These contracts become legible once you read them as funding rather than as procurements. The match rate tells you what the agency can afford to call the work. The APD tells you what CMS already agreed to pay for and when. The cooperative agreement work plan tells you what the health department promised CDC it would build. All three are public or obtainable, all three are written twelve to twenty-four months ahead of the solicitation, and very few bidders read any of them. That gap is the opening.
Our team builds production data, machine learning and cloud systems against exactly these regimes: HIPAA business associate obligations, NIST SP 800-53 baselines, federal tax information handling, and interoperability standards including HL7 FHIR and electronic case reporting. We work as a prime where the vehicle allows it, and as a subcontractor to the module prime where that is the faster path to a delivered result.
Frequently asked questions
Because the federal share changes. Design and development of an approved Medicaid Enterprise module draws 90 percent federal participation under 42 U.S.C. 1396b(a)(3); general administrative work draws 50 percent. Structuring the requirement as a module cuts the state's cost roughly fivefold.
An Advance Planning Document is the state's request for federal approval to claim enhanced match on a system, governed by 45 CFR Part 95, Subpart F. It describes the module, budget and schedule, and CMS approves it well before the RFP is written. Reading approved APDs is the most reliable early warning in this market.
Rarely. Most states need foreign qualification and a registered agent before contract execution, which is administrative. Residency preferences of around five percent exist in roughly half the states and matter mainly in price-dominant evaluations. Prior-experience requirements block far more bidders than geography does.
Individual Medicaid Enterprise modules commonly run $5 million to $60 million over a five-to-ten-year term with options. Public health data work is smaller, roughly $500,000 to $10 million for registry, surveillance and interoperability modernization. Discrete analytics engagements often land between $150,000 and $2 million.
HIPAA business associate obligations under 45 CFR 164.504(e) and the Security Rule at 45 CFR 164.302 through 164.318 are the baseline. Eligibility systems add IRS Publication 1075 and MARS-E, both built on NIST SP 800-53. Substance use disorder records add 42 CFR Part 2, and some states require their own cloud authorization such as TX-RAMP.