EFF Releases 800 Pages of CMS Records Exposing Failures in Medicare's WISeR AI Program

The Electronic Frontier Foundation has published more than 800 pages of internal federal documents revealing widespread operational failures inside the Centers for Medicare and Medicaid Services’ Wasteful and Inappropriate Service Reduction model. Obtained through Freedom of Information Act litigation initiated in March 2026, the records show that at least four of the six private technology contractors hired to run algorithmic prior authorization on traditional Medicare claims received formal requests for information or corrective action orders within the program’s first three months.

Traditional fee-for-service Medicare historically operated without broad prior authorization barriers, distinguishing it from private Medicare Advantage plans where automated claim review has triggered intense regulatory scrutiny and class-action lawsuits. When CMS launched the WISeR pilot across six states only six months after announcing the initiative, agency leadership framed the deployment as a precision tool to curb billing fraud and medically unnecessary procedures. The newly disclosed records demonstrate that the compressed procurement schedule forced contractors into production before their intake portals, clinical rule engines, and clinician notification pipelines were functional.

The structural vulnerability at the center of the WISeR architecture is its contingency-based compensation model. Rather than paying technology vendors a flat per-transaction processing fee or a fixed SaaS licensing rate, CMS structured the contracts so vendors earn a percentage of the federal expenditures saved through denied claims. Civil liberties attorneys and healthcare compliance engineers warn that tying vendor revenue directly to denial volume creates a financial incentive to maximize algorithmic rejections while shifting the administrative burden of appeals onto hospitals and beneficiaries.

Internal compliance correspondence released in the FOIA batch shows how quickly those misaligned incentives collided with clinical reality. Vendors missed mandatory determination turnaround windows, issued automated denials that failed basic clinical accuracy checks, and deployed provider portals that could not reliably ingest medical documentation. In one documented exchange, contractor Innovaccer warned CMS prior to signing its participation agreement that its software platform would not be ready for the January launch date, yet proceeded into production and received a formal Performance Notice of Non-Compliance on February 20, 2026.

Fast Facts: CMS WISeR AI Prior Authorization FOIA Disclosures

• Primary Source & Legal Action: Over 800 pages of federal records obtained via FOIA litigation by the Electronic Frontier Foundation, detailed in EFF’s Deeplinks investigation.
• Procurement Compression: 66 companies applied to participate in the WISeR pilot; CMS selected 6 technology vendors and pushed the program from initial announcement to live clinical operation in 6 months.
• Vendor Failure Rate: Within the first 90 days of operation, CMS issued Requests for Information (RFIs) or required Corrective Action Plans (CAPs) from at least 4 of the 6 contracted AI vendors.
• Documented Vendor Violations: Virtix was cited for slow determination turnaround times and inaccurate claim denials; Innovaccer filed a Proposed Corrective Action Plan on January 16, 2026, and received a Performance Notice of Non-Compliance on February 20, 2026.
• Financial Incentive Structure: Participating WISeR vendors are compensated via a contingency percentage of Medicare savings generated from denied medical claims.
• Transparency Redactions: CMS and its contractors redacted basic algorithmic governance disclosures, including how models are trained, how human reviewers interact with machine recommendations, and what internal guardrails prevent erroneous rejections.

Vendor Compliance Breakdown and Procurement Audit

To evaluate the operational risk of public-sector algorithmic adjudication, the table below maps the disclosed compliance actions and structural characteristics across the WISeR program against enterprise healthcare AI governance standards.

How Compressed Procurement and Contingency Incentives Broke Clinical Routing

The failure modes documented in the CMS records illustrate a recurring anti-pattern in government and healthcare AI procurement: treating probabilistic classification pipelines as drop-in replacements for deterministic administrative workflows without building an integration testing layer. In traditional Medicare claims processing, regional Medicare Administrative Contractors (MACs) evaluate submissions against published Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs). When CMS inserted six external AI vendors into that workflow under the WISeR model, every vendor had to synchronize clinical document parsing, optical character recognition (OCR) over unstructured physician notes, and coverage rule verification within strict statutory turnaround windows.

According to the FOIA documents, that synchronization broke down immediately. Innovaccer notified federal officials before executing its final participation agreement that its intake portal would not be ready on schedule. Instead of delaying the state go-live date or routing traffic back to standard MAC review, the deployment proceeded. By January 16, 2026, Innovaccer had submitted a Proposed Corrective Action Plan to address portal readiness and workflow defects, followed five weeks later by a formal CMS Performance Notice of Non-Compliance on February 20, 2026.

Virtix, another of the six selected vendors, triggered regulatory intervention for both latency and accuracy defects. CMS cited Virtix for failing to meet determination turnaround deadlines and for generating inaccurate claim denials. In a prior authorization environment, turnaround latency and denial accuracy are tightly coupled: when an automated intake pipeline fails to parse an attached clinical note or radiology summary, the system frequently defaults to a “missing documentation” denial or queues the file in an understaffed human review backlog. For surgical centers and outpatient clinics, both outcomes delay patient care and require manual peer-to-peer appeals.

Equally significant for enterprise compliance officers is what CMS withheld from the 800-page release. Applying Freedom of Information Act exemptions for commercial trade secrets and internal agency deliberations, federal attorneys redacted vendor responses describing how their machine learning models are trained, what datasets are used for calibration, and how human clinicians supervise algorithmic recommendations. When a public agency delegates life-and-health coverage determinations to private software contractors while shielding the underlying decision logic behind proprietary redactions, healthcare providers lose the ability to verify whether a denial stems from a valid Medicare coverage policy or a model hallucination over unstructured medical records.

Governance Architecture for High-Stakes Algorithmic Adjudication

For healthcare payers, hospital revenue-cycle teams, and public-sector IT leaders, the WISeR FOIA disclosures provide a concrete blueprint of what happens when algorithmic governance is subordinated to rapid launch dates. Engineering and compliance teams deploying automated claim review or clinical triage systems must enforce strict architectural separation between model inference, financial incentives, and statutory appeals.

The 4-Step Enterprise Implementation Playbook

1. Decouple Vendor Compensation From Adjudication Outcomes: Never structure SaaS or BPO contracts where the technology vendor’s revenue scales with the volume or dollar value of rejected claims, flagged accounts, or denied benefits. Compensation must be tied to verified service-level metrics such as document parsing accuracy, uptime, and audit-confirmed concordance with board-certified clinical reviewers.
2. Enforce Mandatory Shadow-Mode Validation Gateways: Before allowing any prior authorization or claims classification model to issue binding determinations, run the pipeline in silent shadow mode against at least 60 to 90 days of historical and live production claims. Require the vendor to demonstrate sub-1% false-denial variance against independent clinician panels before enabling live provider notifications.
3. Mandate Deterministic Citation Payloads for Every Adverse Action: Prohibit opaque binary risk scores in clinical adjudication. Every automated recommendation to pend or deny a claim must output a machine-readable JSON audit payload citing the exact paragraph of the governing National or Local Coverage Determination, the specific extracted fields from the patient’s electronic health record, and the exact clinical element found lacking.
4. Build Automated SLA Circuit Breakers: Instrument the claims gateway with real-time telemetry tracking vendor portal uptime, document ingestion error rates, and appeal overturn percentages. If a contractor’s appeal overturn rate exceeds a predefined threshold or turnaround latency breaches statutory windows, automatically bypass the algorithmic filter and route claims directly to standard administrative processing.