Framework Healthcare & Human Services
This label comes from a consulting firm's list of CMS healthcare services and, as far as public CMS material shows, refers to the Business Requirements Audit that is one half of the Enhanced Direct Enrollment (EDE) audit package (the other half is the Privacy and Security Audit). Verify the intended scope before relying on this profile.
In the EDE program, an entity that wants to enroll consumers in federal marketplace coverage through its own website must have an independent auditor confirm that its user experience, eligibility application flow, notices, consumer protections, and operational processes follow CMS business requirements before CMS approves it, and then again each year.
In writing, an EDE entity needs its documented business processes and consumer-facing content mapped to the CMS business requirements, an operational readiness review record, agent and broker oversight procedures, consumer consent and privacy notice language, incident and complaint handling procedures, and evidence of testing against the CMS test cases.
The audit report, with any findings and remediation, is submitted to CMS in the annual window.
Prospective and approved primary EDE entities (web brokers, issuers, and technology platforms) operating on the federally facilitated marketplace, and the downstream entities that use their platforms.
The auditor asks for the entity's business process documentation and consumer-facing screens, the mapping to CMS business requirements, test case results, the operational readiness review, agent and broker oversight and licensing procedures, consumer notice and consent language, complaint and incident handling records, change logs since the last audit, and remediation evidence for prior findings.
Neither CMS nor HHS publishes a program by the name CMS Business Assessment. The closest public program element is the EDE Business Requirements Audit described in the CMS EDE audit guidelines. Treat this profile as covering that audit and verify the intended meaning with the source that used the label.
Assessors
Independent third-party auditors engaged by the entity and meeting the independence rules in 45 CFR 155.221 and the CMS auditor guidelines; the auditor for the business audit must have no access or privileges on the system being audited. CMS reviews the submission and approves or denies.
CMS sets auditor qualification and independence requirements in the annual guidelines rather than accrediting firms.
No firm has claimed a CMS Business Assessment assessor listing yet. Claim yours →
Consultants
A small set of consulting and audit firms focused on the CMS marketplace ecosystem provide readiness reviews and act as independent auditors. Engagements are seasonal, running from build and readiness review through submission in the April to July window.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
No firm has claimed a CMS Business Assessment tool listing yet. Claim yours →
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.