Medicare’s AI Prior-Authorization Pilot and the Data Nobody Has Seen

Imagine you are 72, you live in Washington State, and your doctor says a nerve stimulator might finally get your back pain under control. Before January, traditional Medicare rarely asked anyone for permission in advance. Now, for that procedure and a dozen or so others, a request goes to a private technology company that uses AI tools to help decide whether Medicare should agree to pay. If the company says no, it may earn a share of the money Medicare did not spend.

That is the Wasteful and Inappropriate Service Reduction model, known as WISeR, a six-year pilot run by the Centers for Medicare & Medicaid Services (CMS) in six states. In June, 31 members of Congress wrote to the head of CMS asking for basic numbers: how many requests were approved, how many were turned down, how many of those were overturned on appeal. As far as we can find, CMS has still not published those numbers. The most detailed figures in public view came out of a freedom-of-information lawsuit.

Here is how the pilot works, how its companies are paid, and where the record goes quiet. The reusable lesson: when a decision system is paid by its outcomes, evidence about those outcomes is not optional.

What WISeR is

WISeR began on 1 January 2026 and is scheduled to run until 31 December 2031 in New Jersey, Ohio, Oklahoma, Texas, Arizona and Washington (Centers for Medicare & Medicaid Services [CMS], n.d.-a). It applies to traditional Medicare, not Medicare Advantage. It covers a selected list of services that CMS says have historically carried a higher risk of waste, fraud or abuse, with examples including skin and tissue substitutes, electrical nerve stimulator implants and knee arthroscopy for knee osteoarthritis. Emergency services, inpatient-only services and services that would put patients at substantial risk if delayed are excluded (CMS, n.d.-b).

CMS calls it the first Innovation Center model in which “technology innovators are the only model participants” (CMS, n.d.-b). Six companies each cover one state: Cohere Health in Texas, Genzeon in New Jersey, Humata Health in Oklahoma, Innovaccer in Ohio, Virtix Health in Washington and Zyter in Arizona (CMS, n.d.-b). The agency’s participant guide is candid about the inspiration. It says Medicare Advantage plans and other payers have used “AI and machine learning” in prior authorization, and that WISeR aims to apply similar tools in traditional Medicare (CMS, 2026a, section 1.1).

Doctors and suppliers have a choice. They can ask for prior authorization before delivering the service, or skip it, in which case the claim is held for a medical review before Medicare pays (CMS, n.d.-a). Either way, the company reviews the case.

Who decides, and who checks

CMS’s central safeguard is human review. Its published answers say a human clinician with relevant expertise must review every non-affirmation, the pilot’s word for a denial, and that this “cannot be performed solely by technology” (CMS, n.d.-a). Portal requests should be answered within 72 hours, urgent ones within two days (CMS, n.d.-a). Doctors can resubmit, ask for a peer-to-peer conversation with the reviewer, and appeal as usual.

Those safeguards matter. But a human signature on a denial tells you who is accountable, not how the decision was shaped. If an AI tool scores or drafts a recommendation and a reviewer confirms it under time pressure, the quality of oversight depends on things the public cannot see: how many cases each reviewer handles and how often reviewers disagree with the tool.

How the companies are paid

This is the part of WISeR that deserves the plainest possible explanation, because it is unusual. CMS’s model page says participants “receive a percentage of the expenditures associated with averted wasteful, inappropriate care” (CMS, n.d.-b). In other words, the companies are paid out of the savings their reviews produce, and savings in this model mostly come from saying no.

The participant guide sets out the arithmetic (CMS, 2026a, sections 2.3 and 2.4). For a qualifying prior authorization denial, CMS starts from a regional benchmark, the typical Medicare spending for that service locally, treated as the spending averted. For a claim denied after pre-payment review, it starts from what Medicare would have paid. It then subtracts a “WISeR Discount” reflecting how often such claims in that state were already denied in 2025, so companies are not paid for savings Medicare would have made anyway. The company receives 25 percent of the remainder, adjusted by a quality multiplier.

CMS built in brakes. A company is not paid, or has its payment clawed back, if a denial is overturned on resubmission or appeal. It is paid only once per patient for a given service, however many times a request is resubmitted, and it carries the cost of processing every resubmission (CMS, 2026b). The quality multiplier rewards accuracy and timeliness. But the guide also shows its size: a company scoring 85 to 100 percent on quality measures keeps 100 percent of its payment, a company scoring 60 to 84 keeps 95 percent, and a company scoring below 60 keeps 90 percent (CMS, 2026a, Table 3). The Electronic Frontier Foundation (EFF) made the same point from records it obtained: low quality scores reduce payments by only 5 to 10 percent (Cohen, 2026).

The recoupment rule is the model’s main answer to that risk. But it only bites when someone pushes back. A patient who gives up, or a doctor who decides the paperwork is not worth it, leaves the original “no” standing, and in the model’s arithmetic that unchallenged denial still counts as averted spending. How often that happens is exactly what published data could show.

What Congress asked for

On 22 June 2026, Representative Suzan DelBene of Washington and 30 colleagues wrote to CMS Administrator Mehmet Oz. The letter says CMS “has not yet released comprehensive data on the WISeR model’s implementation” and asked for answers by 15 July (DelBene et al., 2026, p. 1). It notes that CMS had earlier told the members that companies’ turnaround times ranged from “within a single day to approximately three days”, and argues that this counted only the company’s decision, not the point at which a doctor receives the tracking number needed to bill (DelBene et al., 2026, p. 1). CMS told Healthcare Dive it would review the letter and respond directly to the members (Olsen, 2026). We could not find a published reply.

The table below sets the main requests in the letter against what we could find in public as of 15 October 2026.

What the letter asked CMS for	What is public now
Number and share of requests affirmed, non-affirmed and dismissed, by state	No official CMS release found. Partial counts for two states appear in an internal contractor report released through EFF’s lawsuit (see below).
Appeal rate and overturn rate for denials	Not found.
Time from request to the doctor receiving a tracking number	Only snapshots: KUOW reports CMS figures of about five days early on, later 1.7 days for prior authorization; internal reports show some much older requests.
Who conducts peer-to-peer reviews, and how often they overturn denials	Not found.
When the first audit will be released	No audit published that we could find.
Performance benchmarks for terminating a company	General rules only: CMS may impose corrective action plans, withhold payment or terminate for poor performance (CMS, 2026b).

What has come out since

A corrective action plan in Washington. Three days after the letter, KUOW reported that CMS had required Virtix Health, the company reviewing requests in Washington, to submit a corrective action plan because it was not meeting the 72-hour turnaround. According to KUOW, CMS said turnaround had averaged about five days in the first four months before improving to 1.7 days for prior authorization (Howie, 2026). DelBene told KUOW the update was “only about the timeline for approvals” (Howie, 2026). Virtix told Healthcare Dive it had not received a corrective action plan (Olsen, 2026). Note what the corrective action concerned: speed, not the accuracy of decisions.

Records from a lawsuit. In March, EFF sued CMS under the Freedom of Information Act. On 8 September it published about 1,000 pages of records produced in that case, including contracts, internal status reports and provider complaints (Cohen, 2026). We opened the combined records and read the pages EFF relied on.

One page is a weekly report from Noridian, the Medicare contractor that handles claims in Arizona and Washington. Its year-to-date table of prior authorization decisions, from late March, records 6,096 decisions received from Virtix in Washington, of which 2,863 were affirmations and 3,233 non-affirmations. For Zyter in Arizona it records 14,301 decisions, 11,590 affirmations and 2,711 non-affirmations, for a combined 5,944 non-affirmations across the two companies (EFF, 2026, p. 322). So in Washington, more than half of the decisions recorded in that table were “no”, while in Arizona fewer than one in five were.

Those counts need care. They are an internal contractor snapshot, not an official statistic. They count decisions, not patients, so a resubmitted request may appear more than once. They say nothing about later reversals, and the gap between states could reflect differences in doctors, services or paperwork, not only the companies. They are the best numbers in public only because nothing better has been published.

Another page, an end-of-March status report covering Genzeon in New Jersey, lists 123 prior authorization requests pending for three days or more, the oldest of them 83 days old (EFF, 2026, p. 234). That backlog includes requests awaiting the company and others awaiting letters or corrections, and EFF has clarified that turnaround figures reflect the whole request pathway, not only the company’s part (Cohen, 2026). Fair enough. But for a patient, the whole pathway is the wait.

EFF also reports that, before launch, Innovaccer told CMS it would go live without full functionality and automatically approve requests meanwhile, writing that “auto-affirming is the only path available” (Cohen, 2026). That is the safe direction for patients, but it means one state’s early results may not test what the pilot was built to test.

The governance lesson: outcomes you pay for are outcomes you must publish

Strip away the Medicare detail and WISeR is a familiar pattern: an AI-assisted step in front of a high-impact decision, a human sign-off, and a vendor paid by outcome. Each choice can be defended. Together they make trust depend on a few records: how often the answer is “no”, how often “no” is reversed, how long people wait, and how often the reviewer departs from the tool. When those records are shared, an incentive to deny can be watched and corrected. When they are not, every reassurance is taken on trust. The same holds for a hospital’s AI triage tool or an insurer’s outsourced claims review: what does the vendor earn from each answer, and who can see how often it is wrong?

What the record does not show

We could not find any official CMS release of WISeR approval, denial, appeal or overturn data, or any published CMS audit of the companies, as of 15 October 2026. We therefore cannot tell you a denial rate for the pilot, and we have not calculated one. The counts above come from one contractor’s internal report covering two of six states, at one point in time.

The record does not show which AI tools each company uses, how often clinicians overrule them, or how many cases each reviewer handles. It does not show whether any individual denial was wrong, whether the pilot has reduced unnecessary care (its stated purpose, and a possible genuine benefit), or how much any company has been paid. We have also not been able to confirm whether Virtix’s corrective action plan has concluded, and we did not rely on second-hand reports that it has.

Questions you can ask

• If you are a patient in one of the six states: ask your doctor’s office whether your procedure falls under WISeR, when the request was sent, and whether it has a tracking number yet. If the answer is no, ask whether the office will resubmit or request a peer-to-peer review, and ask in writing how to appeal.
• If you are a doctor or practice manager: keep your own log of submission dates, decision dates and outcomes. A practice’s own records are currently some of the best evidence there is.
• For your member of Congress: has CMS answered the 22 June letter, and will the answers be made public?
• For any organization paying an AI vendor by outcome: do you receive, every month, the vendor’s rate of adverse decisions, the rate at which those decisions are reversed, and how often its human reviewers disagree with its tools? If not, what are you actually overseeing?

Next step: we will keep watching for CMS’s answer and the first audit. To get it when it lands, along with more plain-language AI accountability reporting, sign up for the free Mercury Brief.

---

FairByDesign is reader-funded. If this helped, get the free Mercury Brief or see ways to support. Support never buys editorial control.

References

Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live. FairByDesign. https://fairbydesign.org/operational-ai-readiness/

Centers for Medicare & Medicaid Services. (n.d.-a). WISeR model frequently asked questions. Retrieved October 15, 2026, from https://www.cms.gov/priorities/innovation/files/document/wiser-model-frequently-asked-questions

Centers for Medicare & Medicaid Services. (n.d.-b). WISeR (Wasteful and Inappropriate Service Reduction) model. Retrieved October 15, 2026, from https://www.cms.gov/priorities/innovation/innovation-models/wiser

Centers for Medicare & Medicaid Services. (2026a, May 1). WISeR participant guide: Prior authorization and pre-payment medical review processes and payment methodology (Version 4.0). https://www.cms.gov/priorities/innovation/files/wiser-participant-guide.pdf

Centers for Medicare & Medicaid Services. (2026b). WISeR model payment methodology. https://www.cms.gov/priorities/innovation/files/wiser-payment-methodology.pdf

Cohen, L. (2026, September 8). New records reveal problems with Medicare’s AI prior authorization experiment. Electronic Frontier Foundation Deeplinks. https://www.eff.org/deeplinks/2026/09/new-records-reveal-problems-medicares-ai-prior-authorization-experiment

DelBene, S. K., et al. (2026, June 22). Letter to Dr. Mehmet Oz, Administrator, Centers for Medicare and Medicaid Services, regarding the WISeR model. U.S. House of Representatives. https://delbene.house.gov/uploadedfiles/final_wiser_letter_june_2026.pdf

Electronic Frontier Foundation. (2026). WISeR FOIA response: Combined records [Records produced by CMS in EFF v. CMS, second interim release]. https://www.eff.org/document/wiser-foia-response-combined-records

Howie, S. (2026, June 25). Feds reprimand private company using AI to review WA Medicare claims over delayed processing. KUOW. https://www.kuow.org/2026-06-25/feds-reprimand-private-company-using-ai-to-review-wa-medicare-claims-over-delayed-processing

Olsen, E. (2026, June 24). Democrats push for more data on Medicare AI prior authorization pilot. Healthcare Dive. https://www.healthcaredive.com/news/democrat-letter-more-data-wiser-medicare-ai-prior-authorization/823581/