CMS Is Updating Its Emergency Waiver Intake System for Disasters and Cyber Incidents

CMS is asking for one more round of paperwork clearance on the system providers and state survey agencies use when emergencies knock normal health care operations sideways. The notable bit is not the Paperwork Reduction Act ritual itself, which is as glamorous as wet cardboard; it is that CMS says the 1135 waiver intake process is being updated to capture more operational detail, including cybersecurity incident effects on patients and facilities.

What It Is

Section 1135 waivers allow HHS and CMS, during declared emergencies, to temporarily relax certain Medicare, Medicaid, and CHIP requirements so care can keep moving when the usual rules are not built for the moment. In the Federal Register notice, CMS describes CMS-10752, the “Submission of 1135 Waiver Request Automated Process,” as a revision of an already approved collection under OMB control number 0938-1384. Comments are due to OMB by July 20, 2026.

What’s Changing

CMS says the Acute Hospital Care at Home program is no longer included in this package. More importantly for emergency operations, the agency says it is enhancing the collection to capture the emergency date, simplify ongoing status updates, and create a more complete picture of cybersecurity incidents by expanding reporting on patient and operational impacts. The system will continue to use a public-facing web form, plus CSV or Excel extracts from state survey agencies and providers through an automated mail handler, for Health Care Facility Operational Status reporting. CMS estimates 4,829 respondents, 4,829 annual responses, and 4,016 annual hours.

Why It Matters

This is not a new emergency waiver policy by itself, and it should not be dressed up as one. But the data plumbing matters. When hurricanes, wildfires, tornadoes, cyberattacks, or other emergencies disrupt facilities, CMS needs enough information to decide whether waiver requests are justified and to understand where beneficiaries may lose access to care. The cyber language is especially worth watching: CMS is explicitly folding patient and operational impact reporting into a process originally built around emergency waiver and facility-status workflows.

That is the quiet policy story here. Emergency preparedness increasingly depends on whether federal systems can ingest real-time operational facts without making already-stressed providers perform paperwork theater in the middle of a crisis. The notice is a small window into that machinery, which is usually when the machinery is easiest to underestimate.

Read the CMS notice in the Federal Register (https://www.federalregister.gov/documents/2026/06/18/2026-12328/agency-information-collection-activities-submission-for-omb-review-comment-request)

CMS Puts Medicaid Managed Care Quality Reporting Back on the Paperwork Clock

CMS has opened a comment window on two Medicaid-related information collections, but one of them is doing the real policy work. The Medicaid Managed Care Quality collection covers state quality strategies, public reporting, and the Medicaid and CHIP quality rating system machinery that is supposed to help beneficiaries compare plans without needing a decoder ring and a very forgiving afternoon.

What It Is

The notice is a 60-day Paperwork Reduction Act posting from CMS, published May 20, 2026, with comments due July 20, 2026. It covers CMS-10249, tied to Money Follows the Person administrative requirements, and CMS-10553, “Medicaid Managed Care Quality Including Supporting Regulations.” The second collection is the one with the sharper Health Policy Signal hook: it sits inside Medicaid and CHIP managed care oversight, where state reporting and public-facing quality information meet beneficiary choice.

What’s Changing

CMS describes CMS-10553 as a revision of a currently approved collection. States are required to develop quality strategies and evaluations of those strategies, engage stakeholders when developing them, make the documents available for public comment, and submit them to CMS at least every three years or when substantial changes occur. CMS also points to Medicaid and CHIP Quality Rating System requirements, including public posting of quality ratings on state websites and a web-based interface intended to let beneficiaries and caregivers compare managed care plans. The burden estimate is not tiny: 673 respondents, 6,114 responses, and 1,444,538 annual hours.

Why It Matters

Quality reporting is where Medicaid managed care often promises clarity and then hands everyone a spreadsheet. The collection matters because these documents are part of how CMS oversees state managed care programs, how states explain their quality goals, and how beneficiaries are supposed to understand plan performance. A public quality rating website can be a useful navigation tool, but only if the underlying data are timely, intelligible, and comparable enough to survive contact with real users.

The burden estimate also deserves a raised eyebrow. More than 1.4 million annual hours means this is not just a small administrative checkbox for states and plans. CMS is asking whether the collection is necessary, whether the burden estimate is accurate, and whether technology can reduce the load. Those are not decorative questions. They go to whether Medicaid quality transparency can become a working consumer tool instead of another noble federal aspiration laminated onto state websites.

Read the CMS notice in the Federal Register (https://www.federalregister.gov/documents/2026/05/20/2026-10102/agency-information-collection-activities-proposed-collection-comment-request)