The federal government needs to pursue a more coherent strategy to prevent the next massive government tech and service delivery failure.
At the beginning of next year, as a result of new requirements in H.R. 1 (aka the One Big Beautiful Bill Act), 43 Medicaid expansion states will be required to verify that certain Medicaid enrollees are working, studying, or volunteering at least 80 hours a month to keep their coverage or are too “medically frail” to work. Much ink has been spilled over the rightness or wrongness of the policy choice, but there is one thing practically all commenters agree on: This is a massive, difficult, and consequential administrative undertaking. It’s also a highly visible and high-stakes test of whether states and the federal government have the ability to implement a duly enacted statutory change to an important part of the social safety net.
And right now, the executive branch is making choices that increase the likelihood that governments at all levels will fail this test. Unexpected, last minute changes in a June guidance document make failure points more likely as states have to adjust and implement untested solutions. CMS can and should delay implementation to more cleanly resolve these concerns and ensure that work requirements are implemented in a way that does not place unnecessary financial or administrative burdens on states, CMS, or enrollees.
In implementing these requirements, the Centers for Medicare and Medicaid Services (CMS) and states affected by the new policy have to clear two hurdles: First, they need to pick a verification strategy to decide who among the millions of potential Medicaid recipients will be eligible under the law; and second, they need to build processes and software that execute such a strategy. These tasks would be difficult in the best of times; similar state projects have failed before, and the social costs of administrative burden and decades of research on program take-up have revealed how poorly implemented paperwork processes can inadvertently deny benefits to eligible recipients. Even programs that have been operating for decades struggle to get this right: The Social Security Administration has been operating the country’s disability insurance system since the 1950s, and advocates say it’s still very difficult for beneficiaries to access the benefits they are entitled to.
As if this wasn’t difficult enough, congressional decisions about the calendar made implementation still harder. States were given until January 2027 to implement these new requirements — an aggressive deadline for a requirement as complex as this one — and CMS was given until June 2026 to issue definitive guidance to them on how to do so. As we argued last fall, this timeline presented real issues for states: backing up from the January deadline left states minimal time to conduct competitive procurements; flow through CMS’s own IT governance process; beta test IT systems; train caseworkers; and take the countless other steps required by modern tech implementation practices. The hurried timeline meant that states had to start immediately: waiting until CMS issued its implementation in mid-2026 would mean that they wouldn’t be able to finish on time. As we pointed out, any unexpected changes in that June guidance would therefore imperil the entire process — and millions of Americans’ insurance coverage — by forcing states to pivot at a point where it would be too late to do a good job. A Healthcare.gov-style meltdown wouldn’t just be a very public administrative failure, it would also likely result in significant coverage losses for those on Medicaid.
The most fair and effective way for states to negotiate all of these challenges is to adopt a strategy that leads with ex parte verification, in which states maximize the use of data already on hand to automatically qualify and re-enroll recipients, thereby cutting down on the need for inscrutable manual paperwork or glitch-prone web portals. Such a strategy is both easier to implement — there’s less testing needed, for example, when the public aren’t interacting with a form directly — and minimizes administrative disenrollment of eligibles. But statutory ambiguity meant that, if this strategy were permissible, CMS needed to communicate expectations to states clearly, early, and often to states.
CMS, to its credit, has incorporated important parts of our recommendations into its strategy. Its June guidance, issued as an Interim Final Rule (IFR) in the Federal Register, formalized important information for states on verification strategy, emphasizing that creative ex parte verification should be the foundation of implementation. CMS also took seriously concerns about data availability and procurement timelines, establishing a “fast-track pathway” for states to access new vendors and making data available to states via a central data hub. These strategies can help reduce states’ reliance on incumbent vendors with spotty track records; create common platforms for states; and ultimately reduce the number of steps that applicants need to navigate on their own. This strategy is the right one, and CMS is right to pursue it to the maximum extent possible.
Yet at the same time, CMS undermined this approach with other provisions in the IFR. Most importantly, CMS introduced last-minute changes to how states should verify “medical frailty” — in essence, requiring states to conduct additional subjective review of the severity of certain medical conditions rather than their mere presence. These changes, which states did not expect, could significantly increase the administrative burden of administering H.R. 1 beyond what is necessary to meet statutory requirements. The changes also directly conflict with CMS’s goals of streamlining eligibility reviews by maximizing automatic, ex parte verification. This pulls both CMS and states off of the better strategic course they had been on for minimal discernible benefit. Furthermore, introducing such a twist with less than six months before implementation leaves states with scant negotiating leverage over their vendors, little wiggle room for system testing, and no cushion in case things go wrong — almost a given with any technology implementation on such a scale, no matter how good of a job has been done up to then. It also forces states to undertake costly rework. Most, if not all, states had already begun building, (and in some cases implementing, these verification processes. Each of these challenges increases both the cost of implementation and the likelihood that something will break when the systems go live in January.
As we recently argued in a public comment, CMS can minimize the chance of a meltdown by recentering automatic verification as the cornerstone of its strategy. It can do this by:
- Maximizing data source flexibility so that states can complete as much ex parte verification as possible and economize on the data they purchase
- Realigning its approach to medical frailty so that states can rely on claims-based automatic classification wherever possible, given how little time remains to select vendors, bring them up to speed, and build a new severity-evaluation process from scratch
- Grant a set of good-faith time extensions to states to metabolize these changes and ensure systems and processes are working as intended prior to implementation.
To successfully implement a policy change as administratively complex as this, states need certainty: about the timeline, about the requirements, and about how CMS will govern the process.
Success will hinge on maximizing ex parte verification
Much of the policy debate over the Medicaid work and study rule has focused on who will be subject to the requirement and who will be exempt — and how the administrative burden associated with making those decisions will drive disenrollment. But provisions governing data sources warrant equal if not more attention. Whether a state can verify eligibility automatically by using data it already holds will determine how many people will keep their medical coverage, how many will lose their coverage, how much of the verification workload will fall to caseworkers, and what implementation will ultimately cost for both states and the federal government.
The more compliance a state can verify ex parte, the lower the burden on Medicaid workers and beneficiaries alike. We are glad to see CMS make clear throughout the rule that states should focus on ex parte verification using “reliable information” first. In this regard, the IFR gets two important things right that will make it easier for states to verify automatically.
First, CMS makes clear to states that quarterly wage data “can be used to derive the number of hours worked.” Quarterly wage records already collected by state labor departments are the most robust, comprehensive, and timely source of income data that all states own. But before this rule, neither the timing of the data’s availability nor its format aligned neatly with the statute’s reporting framework, raising doubts about whether it could be used at all. By allowing this data to be used, CMS is taking a huge step toward reducing the financial and administrative burdens the new work requirements will impose. The uncertainty over whether CMS would in fact allow the use of quarterly wage data had been shaping states’ plans; survey data showed that as of April 2026, 18 of the 43 implementing states had not been planning to use quarterly wage data, while 25 said they had planned to purchase wage data from Equifax’s Work Number. By clarifying the point in the IFR, CMS has given states a powerful tool for verification beyond expensive and incomplete commercial options.
Commercial wage databases carry two serious problems. The first is that their employer coverage is skewed toward larger companies. This means that they are incomplete since they do not capture many of the people employed in small businesses who are more likely to be eligible for Medicaid despite their continued employment. Only 59 percent of firms with fewer than 200 workers offer health benefits, compared with 97 percent of larger firms. Such a gap does not exist in the quarterly wage data file because nearly all employers, regardless of size, have a legal obligation to report their data to state labor departments.
The second serious problem of relying on commercial wage databases is that they are expensive for states to use on an ongoing basis. For example, North Carolina’s Work Number spending nearly doubled between 2022 and 2026, to $22.5 million, and South Dakota’s costs rose nearly 400 percent over the same period. CMS is not insulated either, since its own income verification contract with Equifax has grown so fast that it now requires states to cover a share of the costs. Furthermore, because the federal government matches a large share of state spending on state administration and data collection, reliance on Equifax’s Work Number or other data brokers comes at significant federal cost as states pass along these price hikes to CMS.
As we argued in September, states should use the data they already have rather than create new systems to purchase data, and private data brokers should be a last resort for verifying income. Because the Work Number is priced per query, every beneficiary verified through the quarterly wage file is a query the state never has to buy. In this way, this one sentence in the IFR could potentially save states millions of dollars.
CMS also made plans to make National Student Clearinghouse data available to states through an accessible federal data hub. The administration should follow through on this offer. For beneficiaries who meet the requirement through education, the alternative is manual reporting of school documents and transcripts, which in turn requires manual review by Medicaid caseworkers. A survey of state leaders shows how far states were from this solution on their own: Only 10 of 43 states planned to use Clearinghouse data as of April 2026, with most of the rest still deciding whether they had the capacity to establish these kinds of new data linkages at all. CMS providing states with such a data feed would make it available to every state without dozens of separate procurements and data sharing agreements.
It should be noted that many states designed and procured their verification systems without awareness of these policies due to the truncated implementation timeline. In the same survey, 29 states cited insufficient time as a major barrier to adding new data sources, and roughly half cited the costs of establishing and maintaining new data linkages. Because the guidance was issued at the statutory deadline, roughly six months before implementation, states have little runway to rebuild their approaches around these better sources. More time, or earlier guidance, would have allowed states to capture the full value of these changes. It still can.
CMS’s medical frailty guidance threatens to sink the entire program
Beyond those who satisfy the work or education requirements, a large share of beneficiaries will qualify for exemption through other categories. Those include caregivers, pregnant women, foster youth, and people recently released from incarceration. States can, in general, verify the status of such people reliably and automatically on an ex parte basis using Medicaid eligibility and claims data the state already holds, with no additional reporting from the beneficiary. The rule also designates a broader set of “specified excluded” individuals, which sweeps in categories such as people who are “medically frail,” those with “special medical needs,” SNAP recipients, former foster youth under age 26, and veterans with a 100 percent disability rating.
Among the IFR’s most consequential choices is its treatment of “medically frail” individuals, which, contrary to what states had been building toward, will require manual reporting by some beneficiaries to secure a medically frail exemption.
The statute limits “medical frailty” to individuals who are blind, disabled, or who have a:
- substance use disorder (SUD)
- disabling mental disorder
- physical, intellectual, or developmental disability that significantly impairs one or more activities of daily living
- serious or complex medical condition.
As many read it, meeting any one of these categories qualifies an individual for the exemption. As a result, states have been anticipating a process in which they can identify the qualifying conditions in claims and eligibility data, exempt the people who have them, and reserve manual review for cases this data cannot resolve.
But CMS added a new determining factor to the IFR that was not necessarily required in the law itself, requiring that a condition “significantly impair” the individual’s ability to comply with the community engagement requirement. CMS interpreted the statute “to require consideration of the severity” of one’s condition. A qualifying diagnosis is no longer enough. Those seeking an exemption for medical frailty instead will need to prove that the severity of their condition significantly impairs their ability to work, likely requiring either a clinician form or medical records. The state Medicaid offices will then be tasked with determining if the medical records or provider form are enough to grant the exemption. Rather than an easier-to-administer binary (i.e., that an applicant either has a covered condition or not), suddenly states are thrust into the role of having to make judgment calls about the severity of a condition.
Right now, states are not necessarily equipped to make these judgments. CMS anticipated this difficulty in the IFR, evidenced by its attempts to delineate, in each category of qualifying conditions, which diagnoses actually count. For example, CMS stipulates that an individual with a substance use disorder who has been in recovery for five or more years does not qualify for an exemption. As a result, to qualify for an exemption, someone with an SUD would need to prove through their medical records or a clinician that they have not been in recovery for five or more years. For the “serious or complex medical condition” category, the most subjective of them, CMS does list some qualifying conditions such as an end-stage renal disease orHIV/AIDS, but clarifies that they should be used only to exempt an individual “when such conditions significantly impair” their ability to meet the work requirement. It is this second review that will add significant new burdens. States were already expecting having to assemble a list of conditions that qualify for the exemption, likely using what are known as ICD-10 codes, but now this list will only serve as a first step to proving eligibility for an exemption, as the vast majority of cases will still require meeting the higher standard of significant impairment.
Because states scarcely have the capacity to make these types of decisions themselves, we presume many will rely on findings by doctors. This would lower the burden on states, but the evidence on physician exemption decisions is not reassuring. In a survey experiment testing physician responses to Medicaid work-requirement exemption requests from patients with depression, 54 percent of primary care physicians declined to assist a patient who qualified under their state’s criteria, while 25 percent were willing to assist a patient who did not qualify. Willingness varied with the state, the administrative effort involved, and the physician’s own political affiliation.
CMS allows individuals to self-attest about the severity of their condition during a transition period, meaning they will not need to provide additional evidence until 2028. After that, states will be allowed to accept a self-attestation “only once during the period of enrollment” but must have “reliable information” to verify during their first regularly scheduled redetermination.
This is a Band-Aid. States will still have to build this capability into their Medicaid systems, train staff to manage yet another administrative process, and figure out how to explain a murky concept to applicants.
CMS should reverse course and adopt a simpler definition of medical frailty that only requires states to adjudicate the presence of a condition (a binary yes/no) rather than its relative severity. This would faithfully capture the goals Congress wrote into the statute while avoiding needless complications.
These changes magnify the risks of a costly technology meltdown
As we discussed in our prior analysis, the biggest risk to the entire enterprise is the calendar. Because of the tight timeline, states have been forced to make critical decisions well in advance of definitive guidance from CMS. Working backward from January 2027, accounting for CMS APD approval timelines, state procurement lead time, beta testing, training for case workers, and the actual software development, states needed to make decisions about how to implement CMS guidance months ago. These are precisely the conditions that have led to major government technology meltdowns in the past: rigid statutory deadlines, unclear requirements, compressed timelines, and so on.
These conditions could force states to stick with incumbent vendors with spotty track records in building systems, which both denied states the possibility of better service from nonincumbent vendors and inflated the costs due to lack of competition.
CMS, to its credit, has taken some state to address our recommendations: earlier this year, for example, the agency announced that to support implementation, it would help “fast-track” vendors interested in getting on to the GSA schedules. Additionally, it is our understanding that CMS has been regularly and proactively coordinating with states about the requirements since well in advance of the June deadline for more directive guidance. Further efforts to make data available through a consolidated, free, CMS-managed hub could help some states conduct eligibility checks, though these resources may not have arrived early enough or with enough detail for some states. Nextgov/FCW, a news site that covers federal technology, quoted a spokesperson for the Pennsylvania Department of Human Services that, “CMS was unable to provide details on total cost, support expectations, and long-term maintenance of the product” and that instead Pennsylvania was going its own way in partnership with its technology vendor, Deloitte.
However, the inclusion of the additional medical frailty mandate in this IFR undercuts all of these efforts. By introducing such a major, unexpected system requirement this late in the game, CMS has thrown states exactly the type of curveball that we warned of last fall. At this point, states will be left no choice but to pay whatever price their incumbent vendors demand lest they risk noncompliance. In cases in which they’ve already done work to accommodate this requirement, states will also be forced to spend more of CMS’s and their own money to redo this work.
There are other dangers too. System development, particularly for highly complex, integrated enterprise software of the kind that states use to adjudicate benefits, does not proceed linearly: Any new development can be just as likely to introduce a system-breaking bug today as it was six months ago and as it will be six months from now, just when states will desperately need stable technology to facilitate beta testing and training.
CMS needs a more coherent strategy
It is not too late for CMS to change course.
First, CMS should amend the “medical frailty” proposal contemplated in the IFR. Ideally, it would drop the requirement that states verify whether individual conditions prohibit individual applicants from working, adopting instead the model it had previously signaled: allowing states to determine the qualifying conditions and evaluate eligibility based on the incidence of those conditions alone. If CMS is unwilling to go this far, it can bifurcate its approach: require states to maintain a list of conditions that would absolutely meet the definition of “medically frail” for which states could automatically enroll applicants, and then allow a shorter list of conditions for which further evaluation would be needed.
Second, regardless of whether CMS changes its approach, it should offer all states a good-faith extension of the compliance deadline for states beyond January 2027. In the IFR, CMS has outlined criteria by which it will evaluate “good faith effort exemption[s]” for states, including a provision for:
Any exigent circumstances, such as an administrative or other emergency beyond the agency’s control, impacting the State’s ability to implement the community engagement requirement ….
If CMS chooses to adjust its approach, an extension would clearly be warranted: states would need more time to metabolize the final guideline, update their approaches, and ensure that their systems are ready for a smooth rollout after being disrupted by surprise changes that were out of their control. However, even in the case in which CMS doesn’t change its approach on medical frailty, an extension is warranted for states to accommodate the IFR guidance.
Congress clearly envisioned this possibility when it authorized HHS to authorize good-faith extensions, and CMS should take full advantage of that authority. It would be better to get this right the first time than risk another costly meltdown that explodes the federal budget and leaves Americans with the lingering sense that their government cannot implement duly-enacted Congressional priorities.
What’s next
States have a hard job ahead in meeting the administration’s Medicaid eligibility requirements this year. They are buffeted on all sides: by applicants who need healthcare, by advocates who need clarity, by challenging economic conditions, by shrinking public budgets, lower federal spending, and by myriad other circumstances outside their control. In November, 36 states will choose new governors, each of whom will be starting their terms as these rules go into effect absent an extension. Their to-do lists will be long in the best cases.
CMS has an opportunity to make it easier for them, their teams, and the people they serve to comply with Congress’s statutory intent. It should seize it by continuing to support as much ex parte, automatic verification as absolutely possible while giving states as much time as possible to get it right.
