CSIPE

Published

- 18 min read

When Medicare’s AI Gatekeeper Stalls, Keep the Paper Trail

Artificial Intelligence Medicare Health Privacy Consumer Rights

Books by the author

Compare all 5

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

A doctor in Ohio described patients crying at the bedside while they waited for permission to receive procedures for severe pain. Another provider said surgeries had been cancelled because a tracking number had not arrived after more than a month. One request in the federal government’s own status reports sat unanswered for 83 days. A computer-assisted process sold as a quicker check had become a waiting room with no receptionist.

Those accounts appear in records released by the Electronic Frontier Foundation on 8 September 2026 after it sued the Centers for Medicare & Medicaid Services for information about WISeR, an experiment in prior authorization for Original Medicare. EFF says the release covers roughly 1,000 pages, including contracts, internal reports, provider feedback, payment rules, and technical problems (EFF). The documents do not prove that every delayed request was medically necessary or that a machine personally denied it. They do show a process that repeatedly missed its own clock while patients and clinics struggled to find out what was happening.

Here is the useful response before the politics and the acronym take over. If you or someone you care for has Original Medicare in one of six states and a doctor recommends one of the selected services, ask who owns the authorization request, when it was submitted, and what written decision came back. Keep the dates and documents together. A promise that “the system is working on it” gives you nothing to follow and nothing to challenge.

This is a narrow experiment, not a change to every Medicare visit. It still deserves attention because the records expose a familiar weakness in automated decisions: a human may formally sign the answer while a poor computer system controls the queue, the evidence they see, and the time available to fix an error. The label on the final decision matters less to a person in pain than whether the whole path can be checked.

What the September records actually show

WISeR stands for Wasteful and Inappropriate Service Reduction. CMS launched it in January 2026 for Original Medicare in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington. Six private companies each handle a state. They use what CMS calls “enhanced technologies,” including artificial intelligence and machine learning, alongside clinical review to assess selected requests before a service or before payment (CMS).

The scope is limited. CMS lists examples such as skin and tissue substitutes for wounds, electrical nerve stimulator implants, cervical fusion, epidural steroid injections, and some knee procedures. Emergency services, inpatient-only services, and services that would create a substantial risk if delayed are excluded from the model. People enrolled in Medicare Advantage are also outside WISeR, although their plan may have its own prior-authorization rules.

That distinction is worth checking rather than guessing. A red, white, and blue Medicare card does not by itself tell a family whether every piece of care is being handled through Original Medicare or a private Medicare Advantage plan. The doctor’s billing office can confirm which coverage is being used for the proposed service and whether WISeR applies to the request. If it does, the office, not the patient, normally submits the medical records and receives the tracking number.

CMS says a request sent directly through a WISeR company’s electronic portal should usually receive a determination within three days. An expedited request may be available when delay could seriously jeopardise a beneficiary’s life or health; after the company confirms that risk, CMS says the target is two days (CMS FAQ). Those are the clocks against which the new records should be read.

The first months did not consistently meet them. EFF reports that internal status reports showed significant numbers of requests exceeding 72 hours, including the 83-day example. Feedback from Ohio providers described communication gaps, long waits, cancelled procedures, and patients remaining in pain. The released material also says one vendor warned CMS before launch that its software lacked full functionality and had not received enough end-to-end testing with providers. According to the record cited by EFF, that company planned to approve requests automatically while it finished the missing work because CMS did not delay the start.

Washington had already produced a public warning. In June 2026, CMS required the state’s contractor, Virtix Health, to prepare a corrective action plan after it failed the 72-hour requirement. KUOW reported that CMS audited clinical determinations, communication, portal function, customer service, and timeliness, then began meetings every two weeks to review progress (KUOW). CMS said average prior-authorization time had improved from roughly five days during the first four months to 1.7 days by the time of that report. Improvement and earlier failure can both be true.

The released records add scale, though the numbers need careful wording. EFF says two companies denied more than 20,000 prior-authorization requests during the first three months, and Virtix denied more requests than it approved. That does not establish how many denials were wrong. A service can fail Medicare’s published coverage rules for a sound reason. The troubling combination is high denial volume, known delay, incomplete systems, weak public detail about the models, and payment tied partly to spending that the review prevents.

The machine may control the path without signing the denial

CMS draws a firm line in its public description: a licensed clinician must review every recommendation not to pay. That protection matters. It prevents a software score from becoming a formal refusal with nobody medically accountable for the decision. It does not tell us how much power the software has over everything that happens before the clinician signs.

Think of a hospital pharmacy where a pharmacist gives the final approval, but a sorting machine decides which requests reach the desk, which records appear first, and which case is marked complete. A pharmacist still signs each rejection. Yet a lost attachment, a mistaken label, or a queue that hides an urgent case can control the outcome long before the signature. Human review at the last step cannot repair evidence that never arrived or time that has already been lost.

A prior-authorization system has several jobs. It receives a request, identifies the patient and service, gathers medical evidence, checks that evidence against coverage rules, routes uncertain cases to the right clinician, sends a determination, and gives the provider a unique tracking number for the eventual claim. Failure in any one job can look like a medical disagreement from the outside. A missing record may be treated as missing medical need. A portal problem may look like no request was filed. A late answer may force a clinic to cancel even when approval eventually arrives.

That is why the September release matters even though it does not reveal the full code or training data behind each vendor’s model. The operational records let us see the system around the model. They show whether requests moved, whether portals worked, whether humans could communicate, and whether deadlines held. Those ordinary facts often tell patients more about real safety than a vendor’s claim that its model is accurate.

The word “AI” can distract in both directions. Treating it as magic makes the process sound more capable than the evidence supports. Treating it as the sole villain lets poor rollout, unclear ownership, broken interfaces, and payment incentives escape scrutiny. The technology sits inside an administrative machine. The whole machine needs receipts.

KFF’s February analysis gives useful scale and context. It found that services selected for WISeR represented 5.3 percent of Original Medicare Part B spending in 2024, and that about 207,500 people in the six model states had received at least one selected service that year. Most of the extraordinary spending growth came from the price of skin substitutes, while use of many other selected services changed much less (KFF). CMS separately changed the nationwide payment method for skin substitutes in 2026, a move KFF expected to cut that spending far more directly than prior authorization would.

That context weakens a simple story in which more computer-assisted denials are the obvious answer to rising cost. If price drove most of the increase in the largest category, a payment-policy change attacks the price. Prior authorization asks whether an individual person’s service meets coverage rules. Those are different tools aimed at different causes, and patients should not bear extra delay because the tools have been blurred together.

Payment rules shape what the system notices

CMS says WISeR companies receive a percentage of spending associated with care their reviews avert. The agency also says quality measures adjust those payments, successful appeals are excluded or recouped, inaccurate decisions can reduce payment, and a company with a high error rate can be removed. In theory, those checks make a bad denial costly.

The September records show why the details matter. EFF reports that low quality scores reduce payments by only 5 to 10 percent under the released data guide. A company can therefore face a strong reward for stopping spending and a smaller adjustment for weak quality, depending on the rest of the formula. The exact effect cannot be known from the percentage alone, but it is reasonable to ask whether the balance rewards careful decisions or a large denial pipeline.

Successful appeals provide another check, although appeals only correct the cases that people can carry through the process. A patient may never reach a formal appeal because treatment was postponed, the clinic resubmitted instead, the family accepted a warning about possible cost, or everyone spent weeks trying to learn whether a decision existed. A correction mechanism measures the people who found the door. It misses those who left the building.

Delay also deserves its own cost. A model can save Medicare money when a service never happens, yet some abandoned care may represent exhaustion rather than waste. The programme’s accounting should distinguish a clinically supported denial from a request lost to friction. It should also distinguish a prompt withdrawal after a doctor chooses a better treatment from a cancellation caused by unanswered messages. Counting all avoided spending as the same success would hide the mechanism that produced it.

CMS says provider experience is part of the quality score and that it will audit decisions against Medicare coverage criteria. Those are sensible controls. The newly released complaints show that a survey or audit conducted later cannot be the only signal. A live process needs alarms for requests that have exceeded the deadline, repeated failed submissions, cases without a reachable owner, and offices reporting that a patient’s condition is worsening while the request waits.

For families, the practical lesson is simpler than the payment formula. When an organisation is paid partly according to what it stops, verbal reassurance is weak evidence. Ask for the written rule applied to the case and the document that records the outcome. You do not have to argue about the motives of a company to insist on a traceable decision.

A patient can follow the request without becoming a billing expert

The provider carries most of the administrative duty, and a sick person should not have to learn a federal payment system to receive care. Still, one page of notes can stop a request from dissolving into “we are waiting.” Your notes support the clinic’s work by giving everyone the same dates to work from.

Start by confirming the basics with the doctor’s office. Ask whether the service falls under WISeR, whether your coverage is Original Medicare, and which company or Medicare Administrative Contractor received the request. Then ask for the submission date and the name or role of the staff member who can see the portal. Write those answers down while you are on the call.

Next, ask for the request’s current state in ordinary language. Has it been submitted, returned for more information, approved, not approved, or left without a determination? “Pending” can hide several different problems. If the reviewer asked for another scan, note, or code, ask what was requested, when the office sent it, and whether the portal shows that it was received.

The unique tracking number, often shortened to UTN, matters after a determination. CMS says it is sent with the decision and later placed on the claim. If the office says the request was approved but cannot provide the decision or tracking number, ask it to check the actual response rather than relying on a dashboard colour or an internal note.

Use the programme clock as a prompt, not a weapon. For a standard request submitted through the company portal, ask what follow-up occurred once three days passed. Mail or routing through another contractor may add processing time, so establish how the office submitted it before assuming a deadline was broken. If delay could seriously jeopardise life or health, ask the treating clinician whether an expedited request is medically appropriate. The clinician should make that case with supporting records; a family should not have to exaggerate symptoms to move the queue.

Keep copies of the medical order, submission confirmation, requests for more information, decision, Advance Beneficiary Notice if one is issued, and notes from calls. For each call, record the date, the number used, the person or department, and the next promised action. A simple notebook works. The value comes from continuity when the next person answers.

A calm follow-up might sound like this: “The office submitted the request through the portal on Tuesday. Please tell me whether it was received, whether anything is missing, and the date by which we should expect a written determination.” That question gives the other person three things to verify. “Why is the computer denying my care?” may express the frustration accurately, but it assumes a denial and gives the call handler less to trace.

If the clinic and reviewer point at each other, call 1-800-MEDICARE and describe the gap with dates. Ask where a WISeR beneficiary or representative should direct a complaint about delay. Do not send medical records to an email address found in a social post or search advertisement. Use the contact details in the official CMS material, a written decision, your Medicare Summary Notice, or Medicare.gov.

A warning before treatment and an appeal after a claim are different doors

Prior authorization occurs before a service because the provider wants advance assurance that Medicare will pay. A non-affirmed request means the reviewer has not agreed in advance that the documented service meets the coverage rules. CMS says the physician must then give the beneficiary an Advance Beneficiary Notice of Non-Coverage before providing the service. Read that notice carefully because it may ask you to choose whether to receive care while accepting possible financial responsibility.

An advance warning is not the same as a final claim denial. CMS says WISeR preserves appeal rights if a claim is denied. The distinction can feel absurd when somebody is deciding whether to proceed with an expensive procedure, but it changes which document starts the formal appeal and which deadline applies. Ask the provider to explain in writing what has happened so far and what cost you could face under each choice on the notice.

Do not sign a form you do not understand simply to keep an appointment moving. Ask for time to read it and call Medicare if the options remain unclear. A legitimate office should be able to tell you whether it is asking you to accept possible cost, resubmit the request with more evidence, seek a peer-to-peer review between clinicians, or choose another treatment. Those paths have different consequences.

If Medicare later denies payment, the Medicare Summary Notice is the map for a formal Original Medicare appeal. Medicare says the first level is a redetermination, and the notice gives the filing deadline and the address of the contractor handling it. The request should identify the service and dates, explain why it should be covered, and include supporting material such as a doctor’s note (Medicare). Ask the provider for records that address the stated reason for denial rather than sending a pile of unrelated paperwork.

There are five appeal levels, but most people do not need to memorise them before the first decision arrives. Follow the instructions on the current notice, keep a complete copy of what you send, and record the delivery date. If another family member will speak for the beneficiary, check whether Medicare requires an Appointment of Representative form. Informal family help and formal authority are not always the same thing.

The strongest challenge answers the reason that appears on paper. If the decision says a clinical criterion was not documented, the treating clinician can point to the relevant examination, test, or history. If the wrong service code was submitted, the billing office can correct it. If no decision exists because the request is late, an appeal form for a denied claim may be premature. Trace the stage first.

None of this makes delay acceptable. It keeps the response aimed at the actual failure. A missing portal receipt needs submission proof. A request for more evidence needs the evidence and a new date. A clinical disagreement needs the coverage rule and a clinician’s answer. A denied claim needs the appeal instructions on the notice.

What a trustworthy AI-assisted review would publish

The new records arrive because a civil-liberties group had to sue for them. That fact should shape the standard for the rest of the six-year experiment. A programme that affects access to medical care cannot ask the public to judge it from launch promises and selected averages. It should publish enough detail for patients, clinicians, and independent researchers to see where the queue helps and where it harms.

Start with the path every request took. Public reporting can protect patient privacy while showing counts for submissions, approvals, non-affirmations, requests for more information, withdrawals, resubmissions, overdue cases, and appeals. Timeliness should include a distribution, not only an average. An average of 1.7 days can coexist with a smaller group waiting far longer, and those outliers may contain the serious harm.

Break the results down by service, state, vendor, route of submission, and relevant patient groups where privacy permits. A single overall accuracy score can hide a system that works for common cases and fails people whose records or conditions differ from the majority. CMS sought tests for a geographically varied experiment. The public should be able to see the variation.

Measure the human part too. How many proposed denials did clinicians change? How much time did they spend per case? What evidence was missing when they agreed with the system? How often did a peer-to-peer conversation reverse the direction? A human signature tells us who had formal authority. These measures tell us whether the human review changed anything.

The final accounting should separate several kinds of avoided spending. A service found outside Medicare’s coverage rules belongs in one column. A doctor who chose a better option after useful review belongs in another. A case abandoned after repeated technical trouble needs its own examination. Treating all three as equal savings would reward the process for making itself difficult.

CMS should also publish the consequences of failure. The Washington corrective action became public after providers complained, but families need to know whether deadlines, audit errors, and overturned decisions materially reduce vendor payment. EFF says the current quality adjustment shown in the released guide is 5 to 10 percent. The performance data should show whether that adjustment changes behaviour; a weak adjustment should trigger a contract change.

This is the larger AI lesson. Safety does not live in a sentence saying that a person remains involved. It lives in a measured process where evidence arrives, deadlines trigger action, decisions can be explained, errors can be challenged, and incentives make accuracy more valuable than obstruction. The model is only one component. Accountability has to cover the queue around it.

Keep the receipt, then keep living your life

Most people with Medicare will never encounter WISeR in 2026. It applies only to Original Medicare, six states, and a selected set of services. Even within those states, KFF’s analysis suggests the first-year reach is modest compared with the whole programme. You have permission to ignore the acronym unless a provider says it touches your care.

If it does touch your care, do not spend your strength trying to discover whether an invisible algorithm personally said no. Follow the request that exists. Get the submission date, route, missing-information notices, written determination, tracking number, and name of the office handling the next step. Ask the treating clinician about expedited review when delay creates a serious health risk. Use the formal notice and supporting medical evidence if a claim is denied.

The September records justify scrutiny without panic. They document very long waits, unfinished systems, provider complaints, a corrective action, and a payment design that deserves public examination. CMS’s own rules also give families useful handles: defined time targets, human clinical review for non-affirmations, written notices, resubmission, peer discussion, and preserved appeal rights. Handles only work when somebody keeps hold of them.

A computer can sort a queue. It cannot be allowed to erase the queue’s history. For a patient or carer, one folder of dates and decisions is the practical counterweight. Keep the paper trail, make the next person answer from it, and save your energy for the care itself.

Cyber Security in Plain English sends one email per month. The signup is on this site.

Sources