MassHealth Robotics Processing Automation (RPA) Policy

Since July 1, 2022, MassHealth has required all MassHealth providers, business partners, authorized billing vendors, and other entities authorized by MassHealth (“organizations”) to receive approval from MassHealth to use Robotics Processing Automation (RPA) tools (bots) on MassHealth’s Medicaid Management Information System (MMIS) Provider Online Service Center (POSC) before adopting any bot.

MassHealth understands that RPA tools can reduce the administrative burden of manual data entry and improve operational efficiencies.  However, it’s important that MassHealth manage how these tools interact with the POSC.

Please review the following information regarding MassHealth’s RPA policy and learn how to submit an RPA registration request for MassHealth approval.

Organizations that intend to implement a bot must complete and submit the MassHealth Stage I Registration Form to MassHealth at functional.coordination@mass.gov.

MassHealth will evaluate the RPA Stage I Registration Form to determine approval or rejection.

• If MassHealth cannot approve the submitted Stage I request Registration Form, the review status of the form will be designated as “pending re-submission” and the submitting organization will have an opportunity to resubmit the form within seven calendar days to address any issues identified by MassHealth.
• The request for Stage I Registration may be rejected if
  • MassHealth determines that it cannot approve the resubmitted form, or
  • The submitting organization fails to resubmit the form within seven calendar days.

Once a Stage I Registration Form is approved, MassHealth will assign a Stage I preliminary approval number.

Organizations that have received a Stage I preliminary approval number must complete and submit a Stage II registration request within 90 calendar days of receiving the approval number to MassHealth at functional.coordination@mass.gov.

• If the Stage II registration request is not received within 90 calendar days of MassHealth’s issuance of a Stage I preliminary approval number, MassHealth’s approval of the previously submitted Stage I registration request may be revoked.
• Once a Stage I registration request is revoked, any organization that still intends to request approval to use bots on the POSC will be required to restart the registration process by completing and submitting a new MassHealth RPA Stage I Registration Form. See RPA Stage I Registration Request, above.

To do this, organizations must complete and submit the

• MassHealth RPA Stage II Registration Form.
• MassHealth RPA Agreement and other required attachments.

MassHealth will evaluate the Stage II Registration Form, MassHealth RPA Agreement, and all other required attachments, to approve or reject the request.

• If MassHealth cannot approve the submitted Stage II Registration Form, the review status of the form will be designated as “pending re-submission.” The submitting organization may resubmit the form within seven calendar days to address any issues identified by MassHealth.
• The request for Stage II Registration may be rejected if
  • MassHealth determines that it cannot approve the resubmitted form, RPA agreement, or the other required attachments, or
  • The submitting organization fails to resubmit the form within seven calendar days.
• If MassHealth accepts the Stage II Registration Form, MassHealth RPA Agreement, and all other required attachments, MassHealth will issue a Stage II Preliminary Approval Notice. The Notice will require that the organization identify the User IDs that will be assigned to each approved RPA function.
  • Upon receipt and confirmation of the proposed RPA User IDs, MassHealth will issue the Stage II Final Approval Notice.
  • MassHealth will approve up to a maximum of five bots per Provider ID/Service Location (PID/SL).

RPA User ID

When an organization receives the Stage II Preliminary Approval Notice, it must generate and propose a unique User ID that will be used by the bot to perform the approved functions, such as submitting a prior authorization request.

Each approved function must be assigned a separate and distinct User ID that will be used to perform only that specific function for that specific PID/SL.

The proposed User ID cannot be used on the POSC until MassHealth issues the Stage II Approval Notice.

The approved User IDs must not be used for any purpose other than the specific function for which they are approved as described in this RPA User ID section. 

Organizations approved to use a bot must follow these requirements.

• The approved bot must perform only the function it was approved to perform. If an organization wants one of its bots to perform another function, it must first obtain approval from MassHealth.
• Each bot must perform tasks on the POSC the same way a human would perform them. Specifically, the bot must:
  • Sign in and perform activities within the POSC sequentially,
  • Conduct no more than three login attempts before terminating the activity. The bot must be programmed to alert the end user that an issue has occurred,
  • Not be multi-threaded—that is, it must not perform more than one task at a time,
  • Not conduct concurrent sessions. It must perform one activity at a time within the POSC, and
  • Not submit duplicate transactions.
• The time of day the bot activities are conducted must be balanced between business and non-business hours. Key day-to-day business activities related to the physical delivery of services to MassHealth members should be conducted during the business day where applicable. This would include, for example, checking eligibility before delivering a service.
• The organization may not share its assigned User ID or password with anyone. These credentials  must not be used for any purpose other than the approved RPA tool activity outlined in the approved RPA Stage I and Stage II Registration Forms.
• Passwords assigned to the bot User IDs must adhere to EOHHS security password standards. These standards require that each password
  • Contain at least 12 characters, including
    • 1 lowercase letter
    • 1 uppercase letter
    • 1 numeral, and
    • 1 special character.
  • Passwords must be changed every 60 days, and at least two characters must be changed from all previous passwords.
• MassHealth may require that the bot function as an “attended” bot—that is, a bot that is supervised or aided by a human user.
• The organization must process all RPA product upgrades in a timely manner to ensure that the most efficient and secure version of the bot is being used.

Approved organizations must test each bot within the MassHealth Trading Partner Testing environment before implementing any bot on the POSC. Also, organizations must ensure that the bot is maintained and synchronized with any applicable current and future MassHealth MMIS POSC modifications.

Organizations approved to use RPA tools on the POSC must notify MassHealth of the following:

• Specific changes related to the use of the bot,
• Relevant upgrades to RPA products, and
• The adoption of new RPA products.

Organizations must submit an RPA Modification Request Form to MassHealth if the RPA tool or the activities that the approved bot performs have been significantly modified, as in the following examples.

• Any bot modification that adds an activity that is outside of the scope of the approved Stage II Registration Form—for example, if bot requires access to another screen within the POSC—must be approved by MassHealth before the organization implements any changes.
• The RPA software product will be replaced with another RPA product.
• MassHealth will review the RPA Modification Request Form to determine approval or rejection of the proposed bot modification. If MassHealth determines that it cannot approve the submitted RPA Modification Request Form, the review status of the form will be designated as “pending re-submission.” The submitting organization may resubmit the form within seven calendar days to address any issues identified by MassHealth.

The proposed bot modification may be rejected if

• MassHealth determines that it cannot approve the resubmitted form, or
• The submitting organization fails to resubmit the form within seven calendar days.

Any bot modification that results solely in activities falling within the scope of the organization’s approved Stage II Registration Form may be carried out without notification to MassHealth—for example, if the bot will begin to interact with other data elements within a previously approved POSC screen.

Organizations must notify MassHealth if one of the following RPA modifications occurs.

• An approved bot no longer performs the specific approved function. For example, bot is no longer used or is retired.
• The approved User ID assigned to the bot must be terminated.
• Note: The formerly approved bot cannot be re-purposed to perform other functions on the POSC. To obtain approval to perform a different POSC function, a new RPA Registration Form must be submitted. See the section on RPA Registration, above.
• The RPA tool on record has been upgraded so that it impacts how the bot interacts with the POSC.

All modification notifications must be submitted to MassHealth as follows.

• Submit the RPA Modification Request Form to MassHealth. MassHealth will review the RPA Modification Request Form to determine approval or rejection.
• If MassHealth cannot approve the submitted RPA Modification Request Form, the review status of the modification will be designated as “pending resubmission.” The submitting organization will have an opportunity to resubmit the form within seven calendar days to address any issues identified by MassHealth.
• The RPA Modification will be rejected if
  • MassHealth determines that it cannot approve the resubmitted Form, or
  • The submitting organization fails to resubmit the Form within seven calendar days.

If an organization determines that a new bot is required, it must submit a new RPA Registration request.

Using a bot on the POSC is a convenience to organizations. Any organization that violates the RPA Policy may have its access to submit transactions via the POSC using RPA technology revoked.

MassHealth will monitor the status of all RPA registration requests and each organization’s adherence to the RPA policy.  Some of the key provisions of monitoring, enforcement and compliance are listed below.

• Each approved bot request will be monitored through activation and stabilization.
• All approved bots will be monitored on an ongoing basis to validate that the activity performed on the POSC is consistent with the relevant RPA approval.
• Organizations using bots that perform functions inconsistent with the approved use will be subject to one or more of the following:
  • Outreach and validation,
  • Remediation of violation (opportunity to cure),
  • Suspension or termination of the bot User ID,
  • Prohibition from performing functions on the POSC,
  • Organization-wide ban on the ability to use RPA tools on the POSC, and/or
  • Other remedial actions or sanctions that MassHealth determines to be appropriate. See regulations at 130 CMR 450.238: Sanctions: General.

MassHealth will continue to monitor its MMIS to identify any bot used on the POSC that has not been approved by MassHealth. Any organization using a bot that has not been approved by MassHealth will be subject to the following:

• Outreach and validation,
• Compliance mandate. The organization must complete the RPA registration process.
• If compliance is not achieved within the timeframe set by MassHealth, the organization will be subject to:
  • Suspension or termination of the bot User ID,
  • Prohibition from performing functions on the POSC,
  • Organization-wide ban on ability to use RPA tools on the POSC,
  • Other remedial actions or sanctions that MassHealth determines to be appropriate.  See regulations at 130 CMR 450.238: Sanctions: General.

Each approved organization is wholly responsible for the actions of its bots within the MMIS POSC and must attest to that fact by signing the RPA Agreement and submitting it with the RPA Stage II Registration Form. The terms of this RPA Policy are incorporated into the RPA Agreement.

Organizations must comply with the RPA Policy including, but not limited to, the following statements

• The bot will not troll for data within the POSC and will use the minimum necessary data to complete its transaction in support of an impending service to a MassHealth member or the submission or validation of transactions in support of services provided.
• The bot will perform transactions in accordance with the approved RPA Registration Form.
• The information submitted by the bot is true and accurate and is based upon information required to support an impending service to a MassHealth member or in support of services rendered.
• The activities of the bot must comply with MassHealth provider regulations, including the approved organization’s specific provider regulations found under 130 CMR and 130 CMR 450.000: Administrative and Billing Regulations. This includes, but is not limited to 130 CMR 450.307: Unacceptable Billing Practices.

(A) No provider may claim payment in a way that may result in payment that exceeds the maximum allowable amount payable for such service under the applicable payment method.

(B)  Without limiting the generality of 130 CMR 450.307(A), the following billing practices are forbidden:

(1)  duplicate billing, which includes the submission of multiple claims for the same service, for the same member, by the same provider or multiple providers;

(2)  overstating or misrepresenting services, including submitting separate claims for services or procedures provided as components of a more-comprehensive service for a single rate of payment is established; and

(3)  submitting claims under an individual practitioner's provider ID or service location number for services for which the practitioner is otherwise entitled to compensation.

• An approved bot User ID can be terminated, and an approved organization subject to sanctions or overpayment actions, if it does not comply with the regulations governing the MassHealth program, including the regulations referenced above or if it otherwise violates the terms of the MassHealth RPA Agreement. See regulations at 130 CMR 450.238: Sanctions: General and 130 CMR 450.235: Overpayments.
• Organizations must perform key administrative functions to support the delivery of health care to MassHealth members regardless of bot use. If bots are used, organizations must ensure that there are appropriate business continuity plans in place including, without limitation, plans to mitigate performance impacts of bot error or unavailability, such as manual data entry. The use of bots, including bot error or unavailability, does not excuse or waive the obligations of organizations to execute necessary transactions on the POSC to facilitate the delivery of health care to MassHealth members.

Organizations must validate RPA access on an annual basis.

• MassHealth will notify all grandfathered organizations and those organizations that have received an RPA Stage II Approval notice of their annual validation requirements.
• Organizations must complete the RPA Annual Validation Form provided by MassHealth and validate the following:
  • Baseline organization data, such as contact information, PID/SL,
  • Baseline RPA data, such as functions, tool, etc.,
  • Changes made to any data associated with the bot, such as approved user IDs,
  • Changes made to the utilization of the bot,
  • Anticipated modifications or requests, and
  • Other pertinent information requested by MassHealth on the RPA Annual Validation Form.
• Organizations must submit the completed RPA Annual Validation Form to MassHealth within 14 calendar days from the date that MassHealth notifies the organization that it must complete the RPA annual revalidation,
• Upon receipt, MassHealth will evaluate the RPA Annual Validation Form and determine the organization’s continued compliance with the MassHealth RPA policy,
• Organizations deemed to be out of compliance with the RPA policy must immediately rectify the compliance issue in accordance with this section—Monitoring, Enforcement, and Compliance—of this Policy,
• Organizations that do not rectify the compliance issue or do not complete the annual validation will have their approval to submit transactions using RPA tools revoked.
• Organizations deemed to be compliant with the MassHealth RPA policy will receive an annual validation approval letter and may continue to use the approved RPA tool and functions on the POSC.

Please review the RPA policy to view the full scope of the monitoring, enforcement, and compliance requirements.

Please see the page below for frequently asked questions about the RPA policy and process.

Please submit any RPA registration and modification requests, correspondence, and inquiries to MassHealth at functional.coordination@mass.gov.