AI Governance

HEALTH POLICY BRIEF — Thursday, September 17

WISeR’s burden-reduction promise has collided with its implementation record.

Matt Reid

— 2 min read
Share

Executive Briefing

WISeR’s burden-reduction promise has collided with its implementation record. CMS records obtained through FOIA litigation document a launch marked by incomplete vendor readiness, long turnaround outliers, and provider-reported care disruption. One vendor told CMS it lacked time for end-to-end testing with the provider community and would auto-affirm requests until full functionality was ready; another status report identified a request unresolved across the full pathway for 83 days. Provider survey responses describe postponed or canceled procedures and patients waiting in pain. CMS says WISeR combines AI and machine learning with human clinical review, generally targets 72-hour decisions, and subjects noncompliant participants to corrective action. Sources: Electronic Frontier Foundation, “New Records Reveal Problems with Medicare’s AI Prior Authorization Experiment,” Sept. 9, 2026 (https://www.eff.org/deeplinks/2026/09/new-records-reveal-problems-medicares-ai-prior-authorization-experiment); CMS-produced WISeR records released Sept. 7, 2026 (https://www.eff.org/files/2026/09/07/combined_records_-_2nd_interim_release.pdf), especially pp. 216–17 and 234; CMS, “WISeR Model Frequently Asked Questions,” accessed Sept. 17, 2026 (https://www.cms.gov/priorities/innovation/files/document/wiser-model-frequently-asked-questions).

Policy relevance: This is no longer a theoretical debate about AI in utilization management. The live question is whether CMS can enforce readiness, timeliness, escalation, human review, and patient-safety controls before expanding the model. Physician policy angle: Draft a focused CMS and congressional oversight question set now, using the documented failure modes rather than generic AI principles.

Two Medicare Advantage audits put accountability on plans—but remediation could push paperwork downhill. HHS-OIG found unsupported high-risk diagnosis codes in 183 of 250 sampled enrollee-years for UnitedHealthcare of Wisconsin and estimated at least $46.9 million in 2020–2021 overpayments. In a separate HumanaChoice audit, OIG found unsupported codes in 178 of 220 sampled enrollee-years and estimated at least $130.9 million. OIG recommended refunds; the plans disputed some or all findings and recommendations. Sources: HHS-OIG, UnitedHealthcare of Wisconsin audit, Sept. 15, 2026 (https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-unitedhealthcare-of-wisconsin-inc-contract-h5253-submitted-to-cms/); HHS-OIG, HumanaChoice audit, Sept. 15, 2026 (https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-humanachoice-contract-h5216-submitted-to-cms/).

Policy relevance: The paired findings strengthen the case for plan-level risk-adjustment accountability. Physician policy angle: Monitor CMS recovery and corrective-action decisions, and resist any response that substitutes indiscriminate chart retrieval or new practice documentation demands for plan accountability.

ONC has made small-practice cybersecurity homework more current, not necessarily lighter. Security Risk Assessment Tool 3.7 adds prompts on assessment scope, remote access and telework, asset inventories, system-activity logging, and reassessment triggers; it also updates software libraries and keeps entered desktop data local. ONC explicitly warns that the tool’s survey alone may not identify every organizational risk. Source: ONC, “Security Risk Assessment Tool,” modified Sept. 9, 2026 (https://healthit.gov/privacy-security/security-risk-assessment-tool/).

Policy relevance: The additions target real attack surfaces for small and medium practices, but usefulness depends on clear, proportionate implementation. Physician policy angle: Test the new prompts against one realistic small-practice workflow and flag where the tool identifies risk without giving a feasible mitigation path.

Policy Action Implications

  • Draft the WISeR oversight and corrective-action question set while the source record is live.
  • Pair the two OIG audits in a payer-accountability watch note; track whether CMS remediation shifts burden to practices.
  • Run a small-practice usability check on SRA Tool 3.7 and capture concrete mitigation gaps.

Read more