The 2025 budget law counts only half of Medicaid's errors

The 2025 budget law counts only half of Medicaid’s errors. The law, signed July 4, 2025, adds new program integrity checks on Medicaid enrollees and providers. It also hardens a penalty on states whose eligibility errors exceed 3%, starting in October 2029. Every one of those provisions targets payments that should not have been made.

None of them counts the opposite error. The federal error measure behind the penalty does not attempt to identify cases where a state wrongly finds someone ineligible, according to KFF. A program that counts 1 kind of mistake will drift toward the other.

The proposal at the end is to measure program integrity in both directions.

Key takeaways

• The law adds checks on enrollees and providers. States must check the Death Master File each quarter for enrollees from January 2027 and for providers from January 2028.
• Duplicate enrollment gets a federal system. States must collect enrollee address information from January 2027. HHS must have a system to catch enrollment in 2 states by October 2029.
• The error penalty gets teeth. From October 2029, states with eligibility error rates above 3% repay the federal share above the threshold. Insufficient documentation counts as an error.
• Paperwork drives the numbers. In fiscal 2025, 77% of Medicaid improper payments resulted from insufficient documentation, which CMS says is generally not a sign of fraud.
• Wrongful terminations go uncounted. The federal error measure does not look for people wrongly found ineligible, though 69% of people disenrolled during the unwinding lost coverage for procedural reasons.
• Integrity should be measured both ways. States should report wrongful terminations alongside improper payments, and a data match should start a review rather than end coverage.

What the law requires, and when

The law is Public Law 119-21, which its sponsors called the One Big Beautiful Bill Act. Its Medicaid integrity provisions phase in from the end of 2026 through October 2029. The table lists the main ones with the Congressional Budget Office’s estimates of federal savings.

From KFF’s summary of the law’s health provisions (August 2025), which reports CBO’s estimates.

CBO’s estimates show where the money is. The deceased-enrollee and deceased-provider checks save nothing over 10 years, by CBO’s reckoning. Nearly all of the savings come from the renewal and community engagement provisions. CBO expects the community engagement provision alone to leave about 5.3 million more people uninsured in 2034, according to KFF’s summary.

Supporters of the law argue that more frequent checks keep ineligible people off the rolls. CBO’s savings reflect people who would no longer be enrolled for many reasons, and some of them would no longer be eligible. Critics point to the coverage estimates and to the unwinding, when most people who lost coverage did so for procedural reasons. Both points can be true at once, which is why the way errors are counted matters.

How the provisions interact

Each provision is described on its own, but states will run them together. Renewals every 6 months double the number of times an expansion adult must clear an eligibility check each year. Each renewal is another chance for a returned notice or a missed deadline to end coverage. The community engagement requirements add a monthly condition for the same population, and the duplicate enrollment and death record checks add new data matches on top.

The penalty sits behind all of them. From October 2029, every eligibility decision a state cannot document becomes a potential cost. A state that runs more checks and documents each one will lower its error rate. A state that runs more checks without good data is more likely to shed eligible people along with ineligible ones.

New checks on enrollees and providers

Duplicate enrollment

The duplicate enrollment problem is real. In July 2025, CMS said about 2.8 million people were enrolled in Medicaid or CHIP in more than 1 state during 2024, or in Medicaid and a subsidized exchange plan at once. It estimated the duplication cost about $14 billion a year, according to HHS.

CMS said it would send states lists of people enrolled in more than 1 state, and it asked states to recheck eligibility by late fall 2025. The release said CMS would try to avoid improper coverage loss while doing so.

GAO found the same pattern in a narrower review. Across 6 states, GAO counted at least $1.6 billion in potential overpayments or fraud in fiscal 2023. The federal government and the states made those payments for about half a million people with duplicate coverage, according to a September 2025 report. GAO found that state Medicaid agencies vary in which enrollees they submit to PARIS and how often they submit them. PARIS is a federal data-matching service used to find duplicate enrollment across states.

GAO’s recommendation goes to the heart of the matter. It asked CMS to require that all enrollment data be submitted for matching on a frequently recurring basis. It also asked CMS to require that every match be resolved, by verifying eligibility or ending coverage where appropriate.

Resolution is the step that decides whether a data match helps or harms. A person enrolled in 2 states may have moved without telling the first, which is an error worth fixing. The same match may also reflect a data mistake. A match is a lead, as our piece on anomaly scores argued for fraud analytics.

Deceased enrollees and providers

The death record checks extend practice that many states already follow. For providers, federal rules have long required states to check the Death Master File at enrollment, under 42 CFR § 455.436. Section 71105 adds a quarterly check from January 2028, as our analysis of exclusion lists described.

For enrollees, section 71104 requires a quarterly check from January 2027. CBO expects neither check to change federal spending. A plausible reading is that states already catch most of these cases, and the checks close remaining gaps rather than produce large savings.

Death records carry their own errors. A living person wrongly listed as dead can lose coverage until the mistake is found. The quarterly check should lead to verification before disenrollment, the same way an exclusion match should lead to review before termination.

Renewals and community engagement

The renewal and community engagement provisions rely on the same machinery. CMS issued an interim final rule on community engagement on June 1, 2026. The rule requires states to search available data for qualifying conditions before relying on a person’s own statement, according to Holland & Knight. Self-declaration is allowed only where data are unavailable, and only through January 2028. People who rely on it must provide documentation at the next renewal, such as a provider’s certification or medical records. Comments on the rule were due July 31, 2026.

The rule also asks states to keep “auditable, regularly updated” lists of diagnosis codes for identifying people who may qualify for the medical frailty exemption. That is a data-first design, and a sound one. It will work only as well as the claims data behind it.

Data-first verification is the right instinct. It is also where the unwinding went wrong for many people. Of at least 25.2 million people disenrolled during the unwinding, about 69% lost coverage for procedural reasons rather than because a state found them ineligible, according to KFF’s tracker.

Procedural terminations are not proof that people were eligible. Some would have been found ineligible had they responded. But they are not findings of ineligibility either, and no federal error rate counts them.

The penalty that turns paperwork into money

Section 71106 builds on an old authority. Federal law has long allowed CMS to recoup the federal share of payments tied to eligibility errors above 3%, and CMS first implemented it through the Medicaid Eligibility Quality Control program, according to KFF. The new law limits the good faith waivers that let states avoid the penalty. It requires HHS to reduce federal payments above the threshold from October 1, 2029.

The law also widens what counts as an error. Insufficient documentation errors will be included in the recoupment calculation, KFF notes. That matters because documentation drives Medicaid’s error numbers.

Medicaid’s improper payment rate was 6.12% in fiscal 2025, or $37.39 billion, according to CMS. Insufficient documentation accounted for 77.17% of those improper payments. CMS says such payments are “generally not indicative of fraud or abuse,” and that “improper payment measurement is not a measure of fraud.”

The overall rate is not the number the penalty uses. The 6.12% figure covers all improper payments, including errors in claims from providers. The penalty applies to each state’s eligibility error rate, a narrower measure of whether the state enrolled and kept the right people.

From the CMS fiscal 2025 improper payments fact sheet (January 2026).

The penalty applies only above the line. In rough terms, a state with a 5% eligibility error rate would repay the federal share of the erroneous payments above 3%, not the full 5%.

KFF found 12 states with eligibility error rates above 3% in their most recent PERM review. Those reviews took place during the pandemic and the unwinding, so KFF cautions that they may not predict future rates. CBO estimates the penalty will cut federal spending by about $8 billion over 10 years.

Insufficient documentation is a real failure. A payment made without the required verification of eligibility is a payment the state cannot prove was correct. But a penalty built on documentation will push states to document more, and that can mean asking enrollees for more paperwork. The unwinding showed how often paperwork, rather than eligibility, decides who keeps coverage.

There is a better path to the same number. A state that verifies eligibility through data, and records that it did, lowers its documentation errors without asking enrollees for anything. The community engagement rule already points that way.

What the measures miss

PERM measures whether payments were proper. It “does not attempt to identify or measure instances where a state incorrectly determines” that someone is ineligible, KFF notes. No federal error rate counts wrongful terminations, and no penalty is tied to one.

The reason is built into the method. PERM works by sampling payments in each state, along with the eligibility determinations behind them. Each state is measured on a rotating schedule. A payment counts as improper when it should not have been made or when the state cannot show it was correct. A termination never generates a payment, so it never enters the sample.

Wrongful terminations happen, and they can be found when someone looks. CMS announced in September 2023 that nearly half a million children and other people improperly disenrolled would regain coverage, according to its press release. The cause was a systems problem in 30 states that disenrolled people even when the state had information showing they remained eligible.

That episode is the clearest evidence that eligibility systems err in both directions. It surfaced because CMS asked states to check. Nothing in the 2025 law requires that kind of check on a regular schedule.

A program that counts only the payments it should not have made will never see the people it should not have dropped.

The imbalance shapes behavior. A state facing a recoupment for documentation errors has a clear reason to tighten verification. It has no matching reason to measure how many eligible people the tighter process removes.

Counting errors on both sides

Program integrity should count both errors. A state that pays for an ineligible person has made a mistake. So has a state that ends coverage for an eligible one. The second mistake costs less in federal dollars and more in care. It can also cost money later, when people return through the emergency room or reenroll after a gap.

1. Publish a wrongful termination rate. States could sample terminations the way PERM samples payments, and report how many people were cut off while still eligible.
2. Treat every match as a lead. A duplicate enrollment or death match should start a verification, with notice to the enrollee, before coverage ends.
3. Verify with data first. Ex parte renewals and data checks reduce documentation errors without asking enrollees for paperwork.
4. Count reinstatements. When people are disenrolled and then reinstated within a few months, the first termination was probably wrong. That number is easy to measure, and it is not part of any federal error rate.
5. Pair each new check with an access measure. Every new check on enrollees should come with a count of how many eligible people it removes.
6. Count reversals on appeal. A termination reversed at a fair hearing is a wrongful termination that someone caught. Hearing outcomes are already on record, and they belong in the same report.

What a termination review would look like

A review of terminations could borrow PERM’s design. Each quarter, a state would draw a random sample of people whose coverage ended. Reviewers would check whether the evidence available at the time supported ending coverage. They would also check whether the person reenrolled soon after, which is a strong sign the termination was wrong.

The result would be a rate, measured the same way every quarter. States could report it beside their PERM results, and CMS could publish both. The reporting is not new territory. During the unwinding, states reported monthly renewal outcomes to CMS, including how many people lost coverage for procedural reasons. A state with a low improper payment rate and a high wrongful termination rate would no longer look like a success.

There are fair objections. A wrongful termination rate would take new sampling and new money. States facing the 3% penalty will put their effort where the penalty is. That is the argument for counting both. A measure that ignores 1 side of the error will shape behavior on the side it ignores.

Where Redlake stands

Redlake builds tools that health plans use in utilization review, and many of those plans serve Medicaid. Our rules carry over to eligibility. A machine can say yes, but only a person can say no. Data can renew coverage, and it should whenever it can. A data match should not end coverage until a person has reviewed it and the enrollee has had a chance to respond.

Plans also hold data that states can use. A managed care plan sees recent claims and member contacts long before a renewal notice goes out. Sharing that information with states, within the rules for doing so, is among the simplest ways to verify eligibility without asking members for paperwork.

Every recommendation shows its reasons, so a termination notice should say which check failed and what the enrollee can do about it. Every decision can be reconstructed, so a state should be able to show the evidence behind any termination. We think program integrity means getting eligibility right in both directions, and measuring it that way.

What to watch in the rest of 2026

• The community engagement rule. Watch for CMS’s response to comments on the interim final rule, and for state readiness before the requirements take effect at the end of 2026.
• Guidance on 6-month renewals. Watch for CMS guidance ahead of renewals scheduled on or after December 31, 2026.
• Fiscal 2026 improper payment rates. Watch whether the Medicaid rate falls from 6.12% when CMS reports it.
• State systems for January 2027. Watch whether states are ready for the address and death record checks that start then.
• Termination data. Watch whether any state begins publishing how many terminated enrollees reenroll within a few months.

About this analysis

Method. The Medicaid program integrity provisions of Public Law 119-21 are read alongside CMS data on improper payments and the record of the unwinding, using summaries of the law by KFF and the Congressional Research Service and CMS and GAO documents.

Data notes. CBO’s estimates are reported through KFF’s summary. Unwinding figures are KFF’s totals as of September 2024. Improper payment figures are from CMS’s fiscal 2025 report. The interim final rule is described from a law firm summary. The two-sided measure is this analysis’s proposal.

Sources. KFF summary of health provisions in the 2025 budget law (August 2025). KFF analysis of the PERM program (February 2026). KFF Medicaid unwinding tracker (September 2024). CMS fiscal 2025 improper payments fact sheet (January 2026). HHS release on duplicate enrollment (July 2025). GAO-25-106976 (September 2025). CMS release on reinstated coverage (September 2023). Holland & Knight summary of the community engagement rule (June 2026). Federal regulations at 42 CFR § 455.436.

Frequently asked questions

What does the 2025 budget law change for Medicaid program integrity?

It adds quarterly death record checks for enrollees and providers and a federal system to catch duplicate enrollment. It also requires HHS to reduce federal payments to states whose eligibility error rates exceed 3%, starting October 1, 2029.

When do the new death record checks start?

The quarterly check for enrollees starts January 1, 2027. The quarterly check for providers starts January 1, 2028.

What is the 3% eligibility error penalty?

From October 1, 2029, states with eligibility error rates above 3% must repay the federal share of payments above that threshold. The law limits good faith waivers and counts insufficient documentation as an error.

Does Medicaid measure wrongful terminations?

Not in its federal error rate. PERM measures whether payments were proper and does not look for people wrongly found ineligible.

Will the new checks reduce fraud?

Some will help. Duplicate enrollment is a documented problem, and the new federal system targets it directly. CBO expects the death record checks to have no effect on federal spending. Most improper payments stem from documentation gaps, which CMS says are generally not a sign of fraud.

How many people lost coverage for procedural reasons in the unwinding?

KFF counted at least 25.2 million disenrollments, and about 69% were for procedural reasons rather than findings of ineligibility.