What the CMS Interim Final Rule Means for Health Plans and Health Systems

Introduction

In June 2026, CMS released the interim final rule implementing the new Medicaid community engagement requirement created by Section 71119 of the Working Families Tax Cut (WFTC) legislation. This is the most significant change to Medicaid eligibility since expansion, and it introduces a work-or-activity requirement as a condition of coverage for many adult Medicaid members.

Our December 2025 guide explained the high-level framework. This guide picks up where that left off: the final rule moves from concept to binding operational detail. It spells out exactly how states must verify compliance, who is carved out, how notices and deadlines work, what managed care plans and hospitals can and cannot do, and a documentation standard that tightens in 2028.

At Fortuna Health, we build technology that helps people navigate Medicaid and government coverage. This guide breaks down what changed, what it means for the organizations serving these members, and where the real risks - and opportunities - sit.

The numbers that frame everything

A handful of figures from CMS's own analysis tell the story of this rule. They are worth keeping in mind throughout.

‍

Four dates to plan around

There is a tendency to focus only on the January 2027 start. In fact there are four dates that matter, and the later ones are easy to miss.

• ‍July–September 2026 - Outreach begins. States must start notifying members about the new requirement well before it takes effect. Outreach has to begin roughly four to six months ahead of a state's go-live date, depending on how many months of activity that state decides to require.‍
• January 1, 2027 - The requirement takes effect. Most adults in the Medicaid expansion group become subject to community engagement, and states begin verifying it at application and at each six-month renewal.‍
• January 1, 2028 - Documentation gets stricter. Through the end of 2027, states have flexibility in how members can prove compliance. Starting in 2028, states must require documentation wherever it is reasonably available. The members who rely on harder-to-document activities feel this most.‍
• December 31, 2028 - Good-faith extensions end. States granted temporary implementation extensions must be fully compliant by this date.

A major shift: from annual to six-month renewals

One change underneath the requirement deserves to be called out on its own, because it reshapes the entire member experience. For most adults subject to community engagement, Medicaid renewals now happen every six months, rather than once every twelve months as before.

This single change is the biggest driver of coverage churn under the new rule. Each renewal is a fresh point at which a member has to be re-verified, respond to any requests, and avoid falling through the cracks - and now those points come twice as often. Compounding it, states can take two to three months to process a renewal cohort, so in practice a member may be only about three months into their coverage before the next renewal cycle begins. The effect is a near-continuous re-verification treadmill.

States are given 2 options for how they begin the shift:

• Option 1: Reschedule renewals earlier, provided the individual has had at least 6 months of coverage
• Option 2: Wait until the next scheduled renewal after Jan 1st, then start the 6-month clock (known as “rolling” redetermination)

Who this applies to: adult expansion members

The requirement does not apply to all of Medicaid. It applies specifically to adults in the Medicaid expansion group - low-income adults, ages 19 to 64, who are not pregnant and not enrolled in Medicare. It also reaches a narrower set of adults covered through certain Section 1115 demonstrations, explained below.

Children, people eligible through disability or other traditional Medicaid categories, and anyone on Medicare are not subject to it.

When a Section 1115 demonstration creates affected members

Most states cover their expansion adults directly through the standard State plan, and those adults are clearly subject to the requirement. But some states cover comparable adults through a Section 1115 demonstration instead - and whether those members are affected depends entirely on what the demonstration does.

Demonstrations that DO create affected members. When a state uses 1115 authority to provide full coverage to adults who would otherwise be expansion-eligible - essentially an alternative route to the same coverage - those members are subject to the requirement. The clearest live example is Arkansas, which covers its expansion adults by using the demonstration to buy them marketplace coverage (a "premium assistance" model) rather than enrolling them through the standard State plan.

Demonstrations that do NOT create affected members. Many 1115 demonstrations don't create this kind of full-coverage adult pathway, and people in them are not subject to the requirement through the waiver:

• Family-planning-only demonstrations, which cover just family planning services and don't meet the full-coverage standard. Washington's "Take Charge" program (for people up to 200% of poverty not otherwise eligible) and Mississippi's Family Planning Medicaid Expansion Project (up to 185% of poverty) are examples.
• Narrow, limited-benefit demonstrations for a specific population: for instance, Maine's demonstration covering its low-income HIV/AIDS population.
• Delivery-system and long-term-care waivers (1915(b) and 1915(c) waivers that state operates). These change how already-enrolled people receive their care; they don't make anyone newly subject to the requirement.

The simplest way to think about it: a demonstration matters only for these purposes if it is the mechanism that makes someone covered in the first place, at full benefit levels. If it merely changes how an already-covered person gets their services, it is irrelevant to the requirement.

How verification works: data first, paperwork second

Before getting into the specifics of who is exempt and how compliance is shown, it helps to understand the engine that drives everything else: how a state actually checks whether someone is meeting the requirement. The final rule establishes an order of operations for verification, but follows the principle that absence of data is not proof of noncompliance.

The data hierarchy, step by step

Step one: the state must exhaust data before asking the member for anything. The rule defines exactly what counts as the "reliable information" a state has to work through first:

1. Electronic data sources the state has determined are effective (and documented in its verification plan)
2. Information from other state or local agencies
3. Community-engagement information delivered through the Federal Data Services Hub (or related state electronic service)
4. Information already in the state's eligibility system
5. Information in the individual's own case record
6. Payroll data
7. Claims adjudicated in the preceding 12 months - paid, pending, or denied
8. Encounter data for the preceding 12 months

Step two: only if that fails can the state ask the member. The state may request documents from a person only when it has no reliable data to verify the point, or when the data it has conflicts with what the member reported. Asking the member is the fallback, never the first move.

Step three: confirmed exclusions are applied automatically, and coverage isn't held up. If the state has enough data to confirm someone qualifies for an exclusion - for example, that they are medically frail, based on their claims history - it must apply that status. It can even enroll someone first and verify a suspected exclusion afterward, so coverage isn't delayed while the paperwork catches up.

Step four: if the state still can't verify, it sends a notice. Only after exhausting its data and lack of requested documentation from the member can the state issue a formal notice of noncompliance, which opens the response window described later in this guide.

This "data first" principle matters enormously, because the more a state can confirm automatically, the fewer members ever face a paperwork request or a noncompliance notice.

CMS's own estimate - that 44% of adults can't be verified this way - is really an estimate of data limitations. CMS is working to add new federal data connections meant to streamline and reduce manual automations: the final rule names services and entities like National Student Clearinghouse for verifying school enrollment, the VA for verifying veteran status, and a new federal tool called Emmy (Eligibility Made Easy) that delivers community-engagement data through the federal hub. As each new source comes online, states have up to twelve months to connect to it.

Who is subject to the requirement, and who is not

Within the affected adult population, the rule sorts people into a few distinct buckets that behave very differently. Getting these distinctions right is the foundation for everything else, so it is worth being precise.

Two exemption and exclusion pathways

Excluded. A person who is excluded is not subject to the requirement at all - they aren't even considered an "applicable individual." The state must apply an exclusion whenever it has the information to do so, even if the person also happens to be working or volunteering. Exclusions are durable: they are rechecked roughly once a year rather than at every renewal, and considered established unless something changes. This is the most protective status.

Exempt. A person who is exempt is still subject to the requirement, but is treated as having met it for the month or months they qualify under an exception. This is a temporary, month-by-month status rather than a permanent carve-out. It includes both the mandatory exceptions and the optional short-term hardship exceptions.

When both could apply to the same person, exclusion takes priority.

The full list of excluded categories

The law specifies the groups of "specified excluded individuals" - Medicaid members carved out of the requirement entirely. CMS estimated how large several of them are as a share of the adult population, and two of them, medically frail individuals and caregivers, dominate.

Separately, some people are simply outside the requirement altogether because they aren't in the affected population at all: anyone under 19, anyone enrolled in Medicare, and anyone who qualifies for Medicaid through a group other than the adult expansion group.

The short-term hardship exceptions

States may also choose to offer short-term hardship exceptions, which deem a person compliant for any month in which a hardship applies. These are optional for states, but a state that adopts them must honor all of them. CMS estimated the size of each.

‍

The disaster and unemployment exceptions are notable because they apply automatically based on where a person lives - no individual request is required.

Medical frailty: the most important exclusion to understand

Because medically frail individuals are the single largest excluded group, and because the definition is widely misunderstood, this exclusion deserves close attention.

Medical frailty is a two-part test, and both parts must be met. First, the person must fall into one of five condition categories. Second, that condition must significantly impair their ability to comply with the requirement. CMS deliberately rejected a diagnosis-only reading: a condition that doesn't actually prevent someone from completing their hours doesn't qualify, and the same diagnosis can qualify one person and not another depending on severity.

The five categories - a person needs to fall into only one:

1. Blind or disabled, as defined under Social Security standards (blindness meaning vision of 20/200 or worse in the better eye with correction; disability meaning an inability to do substantial work because of an impairment expected to last at least a year or result in death).
2. A substance use disorder with one important exception, described below.
3. A disabling mental disorder that is disabling, not merely present.
4. A physical, intellectual, or developmental disability that significantly impairs the ability to perform one or more activities of daily living.
5. A serious or complex medical condition.

Conditions that would typically count (always subject to the impairment test) include cancer, end-stage renal disease, HIV/AIDS, sickle cell disease, ALS, Parkinson's, Huntington's, multiple sclerosis, schizophrenia, moderate-to-severe bipolar disorder, major depression, substance use disorders (including people in early or sustained recovery), Down syndrome, cerebral palsy, muscular dystrophy, cystic fibrosis, and serious injuries such as spinal cord or brain injury.

Conditions that would not count include a substance use disorder in stable recovery (meaning five or more years, since at that point relapse risk is similar to the general population) and disability that doesn't impair an activity of daily living. (The statute refers specifically to activities of daily living such as bathing, dressing, walking, and eating - not to instrumental activities like shopping or cooking, so impairment of the latter alone doesn't qualify.) CMS also published a list of conditions it does not expect to significantly impair compliance: asthma, hypertension, anemia, pre-diabetes, Type I and Type II diabetes, obesity, psoriasis, headaches, and ADHD.

How states have to operationalize frailty - and why it's hard

States can't simply take a member's word for it. The rule requires them to build the identification process around data, and that creates real friction:

• States must maintain lists of qualifying diagnoses and conditions. CMS expects these to take the form of ICD-10 medical code sets  and those lists must be auditable, defensible, consistent with the legal definition, and revised regularly as treatment and experience evolve.
• Verification leans on the member's prior twelve months of data (largely claims and encounters that are paid, pending, or denied).
• There must be a request process for someone whose condition isn't on the list to seek individual consideration.
• Provider documentation and attestation is considered an acceptable documentation for medical frailty.
• CMS will audit these decisions through the PERM program. If a state is found approving people as medically frail with little or no support for the conclusion that their condition truly impairs their ability to comply, it is out of compliance - so there is real pressure on states not to be overly generous.

Who can document frailty is broader than just physicians.

When frailty is established through provider documentation rather than claims data, states may accept that documentation from a wide range of practitioners - physicians, nurse practitioners, physician assistants, psychologists, counselors and therapists, clinical social workers, and other practitioners the state credentials - so long as they are qualified under that state's scope-of-practice laws to make the determination.

One major tension: a diagnosis code can flag someone as a candidate for the exclusion, but that may not by itself prove the functional impairment the test requires. This is a separate judgment, and it will vary from state to state. The challenge is compounded by the reality that specialty care is often hard for Medicaid members to access, which means there is likely to be gaps/missing clinical data that could establish frailty. And because some of this data involves substance use and behavioral health, it carries heightened privacy obligations under both HIPAA and the federal substance-use confidentiality rules (42 CFR Part 2).

Watch this closely: the gap between having a diagnosis and proving it impairs you is where the medical frailty exclusion will succeed or fail.

How a person demonstrates compliance

Setting aside the people who are excluded or exempt, everyone else has to show community engagement each required month. There are several ways to do that, and they can be combined.

A person meets the requirement in a given month if they complete at least 80 hours of any combination of qualifying activities, or if they earn at least $580 in income. The qualifying activities are:

• Work is defined broadly. It includes ordinary paid employment, but also self-employment and gig work, in-kind work paid in something other than cash (a building superintendent who receives free rent, for example, counts the hours worked), and unpaid work such as internships or unpaid trial periods when applying for a job.
• Community service but with strict conditions, described in the next section.
• Work programs that are specifically structured employment-and-training programs as defined under SNAP. These include work programs run through state workforce agencies and American Job Centers.
• Education such as being enrolled at least half-time in a qualifying educational program.

If none of these reaches 80 hours on its own, they can be added together. Someone who works 50 hours and volunteers 30 hours through a qualifying organization has met the requirement.

Community service has to be the right kind

Volunteering only counts if it meets four specific conditions:

• The activity must be unpaid work that benefits the community,
• Completed through a structured program,
• Under the auspices of a public or nonprofit organization, and
• By an organization that must track each person's hours and be able to confirm them through a named point of contact.

In practice, this means the organization matters as much as the activity. Volunteering at a food bank, a Habitat for Humanity build, a Red Cross program, AmeriCorps, a city parks or public library program, an animal shelter, or a nonprofit hospital generally counts - as long as the organization keeps records.

Helping a neighbor on your own, joining an informal mutual-aid effort with no organization behind it, volunteering for a for-profit business, or donating money does not count. And real volunteering at a legitimate nonprofit can still fail to count if that organization doesn't track hours or can't confirm them.

Education now reaches more people

The statute originally recognized only two kinds of educational programs: higher education and career and technical education. CMS expanded this in the member's favor by adding two more categories.

• High school - because adults can still be finishing high school for many reasons.
• State-approved high school equivalency programs, such as a GED program offered through a community college.

Self-paced study outside an approved program does not count; the program has to provide real structure. Half-time enrollment satisfies the requirement on its own; less-than-half-time enrollment can still contribute hours toward the 80.

Seasonal workers get special treatment

People whose work is inherently seasonal 0 in agriculture, farming, tourism and hospitality, landscaping, construction, shipping and logistics, or holiday retail - would fail a strict month-by-month test in their off-season, even though they work hard during their season.

The rule accommodates this in two ways. First, a seasonal worker can satisfy the income standard using their average monthly income over the preceding six months, so a strong season can carry the quiet months. Second, where a state has adopted a particular income-smoothing methodology for its regular eligibility process, it can spread predictable seasonal income across the year before the test is even applied. The practical implication is that correctly identifying a seasonal worker can prevent a coverage loss that the plain monthly rule would have triggered - but it requires looking at six months of income history, not a single snapshot, and confirming that the work is genuinely seasonal.

The $580 income standard

The income pathway is the simplest way to meet the requirement, and it is worth understanding on its own.

Instead of counting hours, a person can satisfy community engagement for a month by earning at least $580 - the figure comes from the federal minimum wage of $7.25 multiplied by 80 hours. A few features are worth knowing:

• The threshold is always based on the federal minimum wage, even in states with a higher minimum wage, so the bar is the same $580 everywhere.
• It uses the person's countable income, including tips, which means tipped workers and younger workers in introductory-wage jobs are measured on their total earnings against the same $580 - they aren't held to a different standard.
• The check is done month by month.

If someone's income falls short of $580, it isn't wasted. The state can convert their income into an equivalent number of hours (dividing income by $7.25) and combine those hours with other qualifying activity to reach 80.

Household income versus individual compliance

This subtlety can cause tremendous confusion. The income figure the state uses for the income pathway is the combined household's income - which is the income that Medicaid already uses to decide eligibility.

Working Families Tax Cut (WFTC) applies community engagement to each person individually, not to the household as a whole.

• For a household with a single applicable adult, this is straightforward: if household income is over $580, that individual has met the requirement for the month.
• For a household with two or more applicable adults, the rule is less clear about how one shared household-income figure proves compliance for each of them.

CMS left that question to the states to work out using a "reasonable method” though there is no federal formula. The same open question arises when household income is converted into hours and has to be attributed to a particular person.

The caregiver exclusion in detail

Caregivers are the second-largest excluded group, so the rule's definitions matter. There are actually two doors into this exclusion.

The first is the traditional caretaker relative path: a relative who both lives with and takes primary responsibility for a dependent child (age 13 or under) or a disabled individual.

The second is the broader family caregiver path, which offers three separate routes - and a person needs to meet only one:

• Route one: the caregiver lives with the person they care for and provides regular, non-incidental assistance.
• Route two: the caregiver is a relative who provides regular, non-incidental assistance but lives separately - the classic example being an adult child caring for an aging parent in another household.
• Route three: the caregiver neither lives with nor is related to the person, but provides at least 80 hours of non-incidental care per month.

There is a helpful fallback built in. If someone in route three provides real caregiving but falls short of 80 hours, those hours don't disappear - they count as unpaid work toward the 80-hour activity requirement. And importantly, there is no cap on how many people in one household can qualify: more than one adult in the same home can each claim a caregiver exclusion, assessed individually.

Enrollment versus renewal

The requirement is checked at two main points - when someone applies, and when their coverage is renewed - and the mechanics differ between them.

How much activity must be shown (aka "lookback period")

States choose how many months of compliance a person must demonstrate known as the "lookback period," but the periods differ by stage.

How often verification happens

Two clocks run independently here. The first is the renewal clock: as described earlier, most members subject to community engagement now renew every six months.

The second clock governs how often exclusions are rechecked, and it is more generous. Medical frailty is rechecked annually rather than at every renewal. A veteran's permanent total disability is never rechecked once verified; a temporary disability is rechecked at most once a year. In general, excluded statuses are reverified about once a year and are expected to be re-confirmed automatically from data the state already holds. This is why getting a member correctly classified into an exclusion is critical - it can move them off the frequent-verification treadmill.

Which data proves which exclusion

The kind of information available to verify an exclusion differs between application and renewal, which shapes how each one is handled.

A deadline that bends for community engagement

States normally must decide a Medicaid application within 45 days. But because the new noncompliance process gives applicants a full 30 days to respond, that response window can push the state past its 45-day deadline even when it acts promptly. The rule adds a narrow exception so the state isn't penalized for the delay - but only when the sole cause is the community-engagement response window, and not for CHIP or Basic Health Program applications.

Attestation and who can act for a member

At application, and in the hospital presumptive-eligibility process described later, determinations rely on the member's own attested information - including statements made under penalty of perjury. Importantly, an authorized representative or another adult in the household can submit this information on a member's behalf, which makes assisted models workable for people who can't easily navigate the process themselves.

What happens when someone can't be verified: two response windows

When a state can't confirm compliance, it doesn't immediately cut off coverage. Instead, it issues a notice of noncompliance, and from there two distinct timelines come into play depending on whether the person is applying or renewing. CMS doesn't use the term "cure period," but these two windows function as the system's second chances.

At application - the 30-day response window. When the state can't verify an applicant, it sends the notice and gives the person 30 calendar days from the day they receive it to demonstrate engagement, show they should be deemed compliant, or show the requirement doesn't apply to them. To handle the practical problem that mail delivery is unpredictable, the rule treats a notice as received five days after the date printed on it, unless the person shows they got it later - so the clock effectively runs about 35 days from the notice date. Because the applicant isn't yet enrolled, the consequence of not responding is denial of the application rather than loss of existing coverage.

At renewal - the reconsideration period. This is the single most important protection against avoidable coverage loss. If an enrolled member is disenrolled because they didn't return requested information, and they then submit that information during the reconsideration period, the state must reconsider - and this is mandatory for the large group of members enrolled on a MAGI basis.

Throughout the 30-day window, coverage continues - the state cannot terminate an enrolled member until it has actually determined them ineligible.

No lock-out period

One feature of this rule is more protective than how work requirements have operated in some past state experiments: there is no lock-out. A person who is denied or disenrolled for noncompliance cannot be barred from reapplying, made to sit out a waiting period, or prevented from re-enrolling once they qualify again. If they reapply and meet the requirement, the state must provide coverage with reasonable promptness. The prior noncompliance simply can't be held against them.

A coverage cliff at the Marketplace

There is one consequence of noncompliance that is easy to get backwards, so it deserves a clear statement. When a person loses Medicaid for failing the community engagement requirement, the law treats them as if they were still eligible for Medicaid-level coverage. That sounds protective, but it has the opposite effect: because someone who is eligible for Medicaid-level coverage generally cannot receive Marketplace premium subsidies, this "deemed eligible" status disqualifies them from subsidized Marketplace coverage.

In other words, losing Medicaid here is a coverage cliff, not a bridge. A person can't simply fall back onto subsidized exchange coverage - the same rule that ends their Medicaid also closes off the subsidy that would have made other coverage affordable.

Protections for incarcerated and recently released members

People who are or were recently incarcerated receive two distinct protections.

While a person is an inmate of a public institution, they are a specified excluded individual - not subject to the requirement at all.

After release, a person is deemed compliant for a transition window: if they were incarcerated at any point in the three months leading up to the month being assessed, they meet the requirement for that month without having to do anything. This is a temporary bridge that gives people time to get on their feet, and it gradually phases out as the release date recedes. To verify it, states must be able to identify who is or was recently incarcerated - often by drawing on the data systems built for reentry programs.

Documentation, and what changes in 2028

When a state does need a member to prove something, the rule names the kinds of documents that count, and frames them as ordinary records people can usually produce.

Crucially, the state must accept other kinds of information when documentation genuinely isn't available, and it cannot terminate someone simply for failing to produce a document that doesn't exist.

Document flexibility narrows on January 1, 2028. In 2027, if a member's status cannot be verified automatically via data, states have broad flexibility. They are permitted to treat self-declaration and documentation as similar standards.

Beginning in 2028, self-declaration and attestation is relegated after data and documentation.

The people most affected are those whose qualifying activity leaves the thinnest paper trail - informal and in-kind work, caregiving hours, and volunteering at small organizations.

Common misconceptions

Because the rule is complex, several intuitive assumptions turn out to be wrong. A few worth correcting up front:

"Looking for work counts." General job searching does not satisfy the requirement on its own - there is no standalone "job search" pathway. Job search activity only counts when it happens inside a qualifying work or training program (such as a SNAP employment-and-training or WIOA program), and even then only as a minor component: the supervised job search or job-search-training portion has to be less than half of the program's required hours, because the program's focus is supposed to be on building skills. Job search done purely to keep unemployment benefits doesn't count either, unless it is conducted within a program that meets that same work-program standard.

"Any technical or trade school counts as education." Only programs that qualify as higher education or career and technical education - or the high school and equivalency programs CMS added - count. An unrecognized trade school or self-paced online GED prep does not.

"A serious diagnosis automatically makes someone medically frail." No - frailty requires both a qualifying condition and proof that it significantly impairs the person's ability to comply.

"Tipped workers are held to a lower bar." They are measured against the same $580, counting their full income including tips.

"All volunteering counts." Only volunteering through a public or nonprofit organization that tracks and can confirm the hours.

What this means for managed care plans

Plans sit close to Medicaid members, currently reaching roughly the 80% of the Medicaid population. In the final rule, CMS encourages states to collaborate with plans and lays out several ways that managed care can help:

• Conduct outreach and education support to members about the requirement.
• Share data they already hold to inform the state's determination. CMS calls this "particularly critical" for keeping the state's information current on things like medically frail status and substance-use-treatment participation.
• Refer and connect members to community engagement opportunities like work programs.
• Help members understand documentation.

The final rule also rolls back a 2024 framework that had required states to actively keep member contact information current. With no federal obligation to maintain addresses, notices increasingly risk landing at outdated addresses - and a missed notice means a missed response window, which means avoidable coverage loss. Plans, with their direct member relationships and modern contact channels, are well positioned to help close that gap.

Finally, the burden won't fall evenly. Early analysis indicates the members most at risk of losing coverage are disproportionately women, adults over 40, and people in rural areas, groups that already face barriers to consistent reporting.

What this means for hospitals and health systems

Hospitals are affected through Hospital Presumptive Eligibility (HPE) - the process that lets hospital staff temporarily enroll an uninsured patient in Medicaid at the point of care, creating immediate coverage and a path to full enrollment. HPE is high-volume and a meaningful pathway to lasting coverage: one study of emergency-department encounters covered more than 585,000 HPE patients, and a California study found that roughly two-thirds of inpatient HPE recipients enrolled in full Medicaid within six months.

For health systems, smooth HPE processing protects both patient coverage and reimbursement for care that would otherwise go uncompensated.

The final rule folds community engagement into this process. For any patient who appears to be in the adult expansion group, intake staff must now run a community-engagement screen - by attestation - working through the same logic as a full determination: is the person excluded, do they meet an exception, and if neither, did they show compliance for the one to three prior months the state requires? These questions can only be asked of apparent adult-group patients, and the required lookback varies by state, so a health system operating across multiple states faces different screens in each.

Hospitals will need to update their HPE forms, eligibility notices, and staff training.

The cost and coverage picture

CMS's own analysis makes the scale of this rule concrete. The agency models a 15% disenrollment rate for the adult group once the requirement is fully in effect. About 8.9 percentage points of that comes from people who can't demonstrate compliance, and about 6.4 points from procedural disenrollment - people who simply don't return forms in time.

The rule is also expensive to run. On mail alone, the dominant communication modality for 75% of Medicaid recipients, states have to send notices pre-implementation, at application and renewal, at changes in circumstances, for short-term hardship, for noncompliance, and more.

These one-time and recurring notices cost roughly 80 cents to produce each with additional postage. CMS estimates recurring mailing streams for HR1 could cost more than $60M/year, not inclusive of labor.

Cost to beneficiaries. CMS estimates the requirement will impose roughly $455 million a year in time costs on beneficiaries themselves in gathering and submitting information.

State outreach responsibilities

Before enforcing the requirement, states must run a mandatory outreach campaign - and notably, they must notify everyone in the adult group, not just the people who will end up subject to the requirement. CMS reasoned that a person's status can change (someone turns 19, a caregiver's child ages out, a temporary disability ends), and that states can't reliably identify in advance who will be applicable, so the safest approach is to notify the whole population.

The outreach has specific requirements:

• It must go out through at least two channels: regular mail (or electronic notice, if the member chose that) plus at least one additional channel such as text message, phone, or a website.
• The notices must explain how to comply, who is exempt, the consequences of noncompliance - including the Marketplace cliff - and how to report a change that could start or end an exemption.
• CMS encourages states to partner with managed care plans, hospitals, community health centers, and other trusted organizations to spread the word.

Turning 19: a built-in trigger

One small but useful detail: turning 19 is the moment a person ages into the adult group and becomes subject to the requirement for the first time. Because it is entirely predictable - every member's date of birth is known - it is one of the few triggers an organization can prepare for in advance, reaching the soon-to-be-19-year-old with education before they ever risk a noncompliance notice.

How Fortuna helps

• Identifying exemptions and exclusions at scale - utilizing advanced member data segmentation and automated matching to map risk and tailoring support before outreach even begins.
• Capturing documentation before the 2028 deadline - building records members will need (community-service letters, pay stubs, transcripts) before the documentation standard tightens.
• Multi-channel, multilingual outreach - orchestrating highly targeted digital and voice touchpoints that meet members where they are and bridges communication gap left open by traditional outreach like physical mailings.
• Web application configured to each state's rules - deploying digital architecture configured to state timelines, specific member engagement patterns, and plan-defined preferences.
• Protecting the response and reconsideration windows - embedding precise, state-by-state timelines into digital architecture, ensuring individuals receive contextual support regardless of when they engage in the timeline.
• Compliance by design - structuring every digital touchpoint, conversational AI interaction, and navigation workflow as a structured intake engine, ensuring all captured member evidence is inherently auditable, secure, and fully aligned with evolving state regulatory frameworks.

_{This guide reflects the interim final rule as issued. Many operational details, including state verification plans, what counts as “reasonably available” documentation, and the number of compliance months each state will require, are set at the state level and are still developing, so specific strategy should be confirmed against each state's implementation as it emerges. Several figures cited (the 44% verification gap, the 15% disenrollment rate, and the cost estimates) are CMS projections built on stated assumptions, and should be read as directional rather than precise. This material is informational and is not legal advice.}

‍