CMS Kept Four AI Prior-Auth Vendors on Notice as Medicare Delays Hurt Seniors

The federal agency overseeing Medicare’s experimental AI prior authorization program issued corrective-action demands to four of its six contracted vendors within the first three months of the program, while saying nothing publicly even as it defended the initiative against rising congressional criticism.

More than 800 pages of government records released after a Freedom of Information Act lawsuit by the Electronic Frontier Foundation against the Centers for Medicare & Medicaid Services show a program that was troubled from the start: vendors failing to process requests on time, AI systems issuing inaccurate denials, portals that could not even generate basic tracking numbers, and a payment model that CMS’s own internal records say gives vendors “an incentive to deny as many claims as possible.”

For the 6.4 million Medicare beneficiaries in six states whose access to covered procedures now passes through these systems, the newly released documents provide the clearest look yet at what went wrong and what the agency knew but did not disclose.

WISeR: The First AI Prior Authorization Program in Traditional Medicare

The Wasteful and Inappropriate Service Reduction model, or WISeR, is a six-year pilot operating in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington. Launched on January 1, 2026, it is the first time traditional fee-for-service Medicare has applied AI-based prior authorization at scale to Part B services. CMS announced the program six months earlier, leaving vendors and the health care industry little time to prepare.

Before WISeR, traditional Medicare rarely required prior authorization for Part B procedures. Medicare Advantage plans, the private-insurance alternative, used prior authorization extensively and had a national approval rate near 92 percent. WISeR’s introduction of AI into fee-for-service Medicare is a major policy shift, and that 92 percent benchmark is important: in Texas, WISeR’s AI systems initially approved only 62 percent of requests, rising to 84 percent after human clinical review. That gap suggests the AI systems were marking too many legitimate care requests as potentially inappropriate.

CMS hired six private AI vendors to review prior authorization requests for skin substitutes, spinal interventions, electrical nerve stimulators, and knee arthroscopy. Under the program, vendors issue “affirmation” or “non-affirmation” decisions, and non-affirmations must be reviewed by a human clinician before becoming final denials. CMS announced WISeR and put it into operation just six months later, despite objections from medical providers, hospitals, and lawmakers from both parties.

A Compressed Launch Left Vendors Struggling and Patients Waiting

The records show that the six-month span between WISeR’s announcement and launch was not just tight; it was operationally damaging. CMS had privately noted the “extremely condensed timeline” in internal records, but it did not publicly reveal the full scope of vendor problems now visible in the released documents.

Within the first three months, CMS sent requests for information or corrective action plan requests to at least four of the six vendors:

Virtix received an RFI in March 2026 citing “determination turnaround times that exceed established guidelines,” “denials that appear inaccurate or inconsistent with applicable criteria,” and “inadequate customer service.”

Zyter, which uses Palantir software infrastructure, received a February 2026 RFI stating that CMS had received reports the company was “not issuing determination letters in a timely manner” and may “lack adequate processes for responding to and escalating provider/supplier concerns.”

Innovaccer had the worst record of the six. CMS issued two separate corrective action plan requests and a formal “Performance Notice of Non-Compliance” after the company failed to provide a working provider portal by launch. In its response to CMS dated January 16, 2026, two weeks after launch, Innovaccer said it had warned the agency before the program began — and even before signing its Participation Agreement — that it might not be ready to deliver full portal functionality by go-live. CMS launched anyway.

A fourth unnamed vendor pointed to “technical and workflow stabilization challenges” caused by a compressed implementation timeline; it had entered the program a month later than the other five vendors.

All of this compliance correspondence, described in the documents released Tuesday, was hidden from public view while CMS was defending the program in the same period. The agency did not disclose any corrective-action requests.

The human toll appears in the records as well. One prior authorization request went unanswered for 83 days, far beyond the required 72-hour turnaround. Physicians described patients in pain waiting for spinal injections while vendor systems produced error messages instead of the Unique Tracking Numbers needed to process authorizations. A status report dated March 30, 2026, marked the end of the first quarter and recorded 5,944 denials from only two vendors.

CMS’s Own Records Point to a Denial Incentive

The most significant disclosure in the new records is not a vendor failure but CMS’s own wording. Internal agency documents acknowledge that the payment structure gives vendors “an incentive to deny as many claims as possible,” according to CMS’s internal language.

That statement, found in the agency’s own records, is what EFF has been trying to bring to light. Vendors are paid in part based on the cost savings their systems generate through denials. Quality-score penalties for incorrect decisions exist, but they amount to only 5 to 10 percent of payment, which is not enough to offset the financial reward for aggressive denials.

The problem is not limited to incentives alone. WISeR combines that financial structure with a “human in the loop” review process that research suggests is vulnerable to automation bias, the tendency for people to defer to algorithmic recommendations instead of independently judging the case.

That combination can be worse than either element on its own: an AI system pushed toward denial by financial incentives sends a non-affirmation to a human reviewer who may already be inclined to accept the algorithm’s output, all under a 72-hour deadline that research says can intensify that deference. The result may be more denials of legitimate care than the AI would produce alone, while also offering less meaningful oversight than a purely human review.

What “Human in the Loop” Really Means Remains Unclear

CMS has repeatedly pointed to clinician oversight as WISeR’s main safeguard. Its FAQ says non-affirmations must be reviewed by a licensed clinician and “cannot be performed solely by technology.”

The new records, however, raise serious questions about how effective that review is in practice. The public still lacks enough information to judge it.

The AI prior authorization process works by taking claims metadata — procedure codes, submitted clinical documentation, provider identifiers, and billing history — and generating an affirmation or non-affirmation recommendation. Non-affirmations go to a human clinician for review. What CMS has not disclosed is how long those reviews take on average, how often human reviewers reverse AI non-affirmations, or what information reviewers see beyond the data the system flags.

That gap matters. In Medicare Advantage, court cases have already raised concerns about failures in human-in-the-loop systems. A class-action lawsuit accuses UnitedHealth Group of using its nH Predict AI system to generate systematic denials of post-acute care for Medicare Advantage enrollees, with allegations that the company pressured human reviewers to follow the AI’s denial recommendations. Separately, an investigation by ProPublica and The Capitol Forum reported that one major insurer, Cigna, used a process in which physicians rejected claims after spending an average of 1.2 seconds per file.

One WISeR vendor’s application touts “Human-in-the-loop (HITL) workflows,” “Continuous model monitoring,” and “Transparent audit trails” as safeguards. That same vendor was later flagged by CMS for inaccurate denials. Whether WISeR’s HITL process offers real clinical oversight or merely procedural cover for automated decisions remains impossible to verify because CMS redacted safeguard details from the records it released.

What Was Redacted, and Why It Matters

In at least one vendor application, a section describing safeguards “ensuring the responsible and clinically appropriate application of automation” was blacked out in the records released to EFF. CMS is allowed to protect trade secrets and confidential commercial information under FOIA Exemption 4, but the result is that the public cannot independently judge whether these systems have adequate protections against biased, inaccurate, or erroneous outputs.

The issue of training data is also unresolved. WISeR vendor applications refer to inputs such as “provider behavior,” “patient demographics,” “utilization management datasets,” “provider and payer performance metrics,” and “historical claims data.” How those data are weighted is proprietary and undisclosed.

That lack of transparency has real consequences. If the training data reflect historical denial patterns by geography, specialty, or patient demographics, the AI may simply learn to reproduce those patterns, not because they indicate fraud or waste, but because they correlate with the features the model was trained to identify. CMS guidance for Medicare Advantage warns against making coverage decisions based on “population-based” criteria instead of individual patient need. The same concern applies here, and the public has no way to confirm whether it is being followed.

What the FOIA Case Has Revealed

EFF filed its FOIA lawsuit against CMS on March 25, 2026, with help from Stanford Law School’s Juelsgaard Intellectual Property & Innovation Clinic, after the agency failed to respond to a request filed in January. Tuesday’s release is the second major batch of documents from the case. The first, published September 8, 2026, included about 1,000 pages showing 72-hour turnaround violations, delays in care, and patient harm. The latest release adds corrective-action correspondence, vendor applications, and contract documents, including applications from all 66 companies that sought to participate in WISeR, not just the six selected vendors.

All of the more than 1,800 pages released so far are available on EFF’s litigation page.

Congress Has Raised Concerns, but No Repeal Has Passed

WISeR has drawn bipartisan opposition in Congress. Medical groups, patient advocates, and lawmakers from both parties warned against the program before it started, but those warnings were not acted on.

A Senate vote to repeal WISeR failed 46-50 along party lines. Senate Democrats, including Sen. Ruben Gallego of Arizona, later introduced legislation to repeal the program through the Congressional Review Act. The Government Accountability Office ruled in May 2026 that WISeR is a rule subject to the Congressional Review Act, opening the door for that repeal vote.

In a blog post tied to the document release, EFF staff Lena Cohen and Matthew Guariglia urged Congress to “place greater legal limits on the use of automated decision-making in Medicare” and called on CMS to disclose how clinician review is actually carried out and what data the AI systems use.

“By outsourcing decision-making to private AI companies without sufficient transparency, testing, or legal limits,” they wrote, “WISeR jeopardizes seniors’ access to medical care.”

What It Means for Patients and Doctors

WISeR is a six-year pilot set to run through 2031, and CMS has said it could expand geographically and to more services. The evidence gathered in EFF’s lawsuit suggests that, at least in its first year, the program created new barriers to care for Medicare patients in six states — barriers that corrective action plans issued months later cannot erase.

Medicare beneficiaries in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington whose prior authorization requests are denied can appeal. Given the early accuracy problems documented in the records — including the 62 percent initial approval rate in Texas and 5,944 denials in the first quarter from just two vendors — the paper trail supports appealing non-affirmations and submitting full clinical documentation, since automation bias may make additional information more influential when it reaches a human reviewer.

What still needs an answer is the question CMS has not addressed: are human reviewers in WISeR’s HITL process seeing complete clinical information, how long are they spending on each case, and how often do they reverse AI non-affirmations? Until CMS provides those numbers, the safeguard remains an assertion, not a proven fact.

Frequently Asked Questions

What is WISeR, and how does it affect Medicare coverage?

WISeR, the Wasteful and Inappropriate Service Reduction model, is a CMS pilot program operating in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington since early 2026. If you are enrolled in fee-for-service Medicare in one of those states and your doctor orders a procedure covered by WISeR — such as skin substitutes, spinal injections, electrical nerve stimulators, or knee arthroscopy — a private vendor’s AI system will review your prior authorization request before Medicare pays. A non-affirmation does not automatically become a denial, because CMS requires a human clinician to review it first. But the records show early AI approval rates in Texas as low as 62 percent, and some cases took 83 days to resolve despite a required 72-hour turnaround, suggesting the program has already delayed access to care even when approval eventually comes through.

If there is a human reviewer, why do researchers say the safeguard may not work?

The concern is automation bias, a well-studied tendency for people to accept an algorithm’s recommendation instead of independently assessing the case. Research in clinical and non-clinical settings shows that time pressure, heavy workloads, and the way information is presented all make that deference more likely. WISeR’s 72-hour deadline creates exactly the kind of pressure associated with that effect. The financial model adds another layer: vendors are rewarded for cost savings from denials, so the AI is pushed toward denial, and the human check may be prone to follow the algorithm. CMS has not disclosed override rates or review times, so the public cannot tell whether the process is correcting errors in a meaningful way.

What did CMS know about vendor problems, and when?

According to the documents released Tuesday, CMS sent requests for information or corrective-action plans to at least four of the six WISeR vendors within the first three months of the program. Innovaccer told CMS in January 2026 that it had warned the agency before launch that it might not be ready. CMS did not publicly disclose any of that correspondence, even while defending the program. The records also include CMS’s internal statement that the payment structure gives vendors “an incentive to deny as many claims as possible,” language that never appeared in public CMS communications about WISeR.

What can patients and physicians do if they think a WISeR denial is wrong?

Medicare beneficiaries can appeal prior authorization denials, and the documented inaccuracy in WISeR’s early months — along with CMS’s own acknowledgment of the incentive to deny — provides a factual basis for doing so. Physicians can strengthen appeals by sending complete clinical documentation directly rather than relying on what the AI may have pulled from claims metadata alone. The released records are available through EFF’s case page, and beneficiaries can also contact their members of Congress, especially representatives from the six WISeR states where repeal efforts remain active.