Medicare’s Wasteful and Inappropriate Services Reduction (WISeR) model put AI-assisted prior authorization inside Original Medicare on January 1, 2026, across six states — with the technology companies performing the reviews compensated based on a share of averted expenditures. This analysis maps the model’s first six months against a confidence-scored governance framework: the incentive architecture, the GAO determination that the model notice is a rule, the first contractor corrective action plan, and what the enforcement record signals for every payer that follows.
Every finding in the full paper carries a confidence rating, and published findings update as the evidence does — the same three-pass discipline every 5Q engagement is delivered with.
Enforcement arrives: the Virtix corrective action
In late June 2026, CMS ordered Virtix Health — the model participant for Washington State — to submit a Corrective Action Plan after finding the company out of compliance with the model’s required 72-hour turnaround for prior-authorization and prepayment determinations. The finding followed an audit across five domains: clinical determinations, communications, portal functionality, customer service, and timeliness. CMS now holds biweekly performance-review meetings with the contractor.
Read against the NIST AI Risk Management Framework, the corrective action documents a deployer-ecosystem failure across three functions: third-party oversight that relied on complaint-driven detection rather than proactive monitoring (GOVERN); a 72-hour standard that existed on paper from launch with no published mechanism tying measurement to consequence until the CAP (MEASURE); and post-deployment monitoring retrofitted under federal supervision that ISO/IEC 42001’s operational controls would have required as a condition of go-live (MANAGE).
Root cause, by the Five Whys
The timeliness violation is the symptom. The compensation model is the condition.
Current status — as of July 13, 2026
Congressional Review Act. GAO concluded on May 12, 2026 (B-337994) that the WISeR model notice is a rule that CMS failed to submit to Congress, opening an expedited-consideration window. Joint resolutions of disapproval were introduced May 20 (Sen. Wyden; Reps. DelBene and Landsman). As of this date, no Senate floor vote on S.J.Res.192 appears in the public record, and the fast-track window flagged by analysts (~July 11) has passed — leaving ordinary procedural paths, and the appropriations process, as the live vehicles. Even with passage, a presidential veto of the administration’s own model remains likely; 5Q’s planning assumption is that WISeR remains operationally active through FY2027.
Appropriations. The House Appropriations Committee adopted an amendment barring federal funds for WISeR — evidence of bipartisan discomfort, though it would not bind before October 1, 2026 and faces Senate negotiation.
Gold-carding. The exemption program was scheduled to launch July 6, 2026 in Washington State — providers achieving a 90% affirmation rate on at least 10 requests during the assessment period are exempted from review — with rollout to additional states to follow. Post-launch operational reporting is not yet available.
Transparency litigation. The Electronic Frontier Foundation’s FOIA action against CMS, seeking disclosure on the AI tools used by model participants, remains the confirmed litigation front.
Patient impact. Press reporting from the six states documents delays and error patterns — including approximately one hundred patients queued for epidural procedures at one Washington academic health system, payment delays stretching multiples beyond the promised turnaround, and initial approval rates in Texas near 62% that rose to 84% after physician review.
Confidence map (v1.1, status-adjusted)
| Finding / development | Confidence | Basis / what would change it |
|---|---|---|
| CMS ordered Virtix to submit a CAP for 72-hour turnaround violations across five audit domains. | HIGH | Press reporting of CMS statements; congressional-office confirmation. Direct CMS letter not yet public. |
| Virtix disputes formal receipt of the CAP. | HIGH | On-record company statement to trade press. |
| WISeR notice is a CRA “rule” improperly withheld from Congress. | HIGH | GAO B-337994, read directly. |
| Contingent-fee model: participants compensated via a share of averted expenditures. | HIGH | CRS IF13133; CMS FAQ; concurring press reporting. |
| No Senate floor vote on S.J.Res.192 occurred within the expedited window. | MED | Absence-of-evidence finding across congressional tracking and trade press through July 13; a recorded vote would change it immediately. |
| Repeal outcome: veto likely; model operationally active through FY2027. | MED | Analyst projection; inherently predictive. |
| All six regional participants have failed CMS standards to comparable degrees. | LOW | Advocacy-source claim; only the Washington enforcement action is confirmed. |
| Applicability of Azar v. Allina notice-and-comment reasoning to WISeR challenges. | FLAG | Analogical application; no filed complaint verified as advancing it. Verify pincite and posture before external citation. |
Why this is the case study
WISeR is the deterministic-to-generative rupture with a docket number attached. Traditional Medicare adjudication had published logic and appeal pathways; the model arrived with neither published model documentation nor demonstrated operational monitoring — and six months later, the retrofit is happening in public, under federal supervision, at the contractor’s expense. For every payer and health system deploying algorithmic utilization review, the lesson is the 5Q thesis in one sentence: governance as infrastructure means building the oversight apparatus before deployment — because six months after launch is when the letters arrive.
v1.0 · June 2026 · Initial six-month analysis
v1.1 · July 2, 2026 · Enforcement supplement: Virtix CAP, CRA posture, appropriations, gold-carding, revised confidence map
This page · July 13, 2026 · Status note updated (CRA window lapse; gold-carding launch date passed); confidence map status-adjusted