States could build Medicaid work requirements from the statute before the rule arrived

The week

No single event defines this week. By this point in 2026, state Medicaid agencies were deep in preparation for the community engagement requirements in the July 2025 reconciliation law. The law requires states to apply them to adults in the expansion population aged 19 to 64 by January 1, 2027, with good-faith exemptions possible through 2028. Members must show 80 hours a month of work, community service, a work program or half-time education, or equivalent income, unless exempt. CMS had to issue an interim final rule by June 2026. In the meantime it had issued sub-regulatory guidance, and on January 29 it announced pledges from ten eligibility system vendors of more than $600 million in free or discounted products and services. State budget proposals that spring included money for eligibility system changes.

Most commentary on Medicaid work requirements argued about the policy. State Medicaid directors and eligibility CIOs had a narrower problem in March 2026. The deadline was fixed in statute, about nine months away. The federal rule that would settle many details was not due until June. Waiting for the rule meant starting a large system change with six months left. Starting without it meant building on assumptions that might be wrong.

The way through was to sort the work by how much the rule could change it. We see three categories that together cover the build. First, what the statute already fixed, which could be built now. Second, what the rule would decide, which should be built as configuration. Third, what had to be contracted now, because delivery capacity was finite.

Build now: what the statute fixed

The law settled the population, the monthly standard, the qualifying activities and the list of mandatory exemptions. It also directed states to use available data to verify compliance where they could. None of that depended on the rule.

That made data connections the safest early investment. Linking the eligibility system to state wage records, SNAP and TANF case data, and education and workforce program enrollment would be needed under any plausible rule. So would the matching logic that decides when a record is good enough to count. Each member verified from data is one fewer notice, portal visit or call. CMS had also pointed states toward automated, consent-based verification of income and activities, including an open-source verification tool.

Exemption identification fell in the same category. Pregnancy and postpartum status, disability and serious illness, caregiving and recent incarceration are often visible in data the state already holds. A state could build the queries and test them against current members long before the rule arrived. It could also measure, early, the share of the affected population it could verify or exempt without asking anything of the member. That single number drives call center staffing, notice volumes and, ultimately, how many eligible people lose coverage for procedural reasons. Arkansas’s 2018 experience, where research found that many people who lost coverage appeared to be eligible or exempt, showed how much that number matters.

Configure later: what the rule would decide

Several choices were left to CMS or to state options the rule would shape. How many months of past activity a state checks at application. How often it re-verifies. Whether short-term hardship exemptions are offered. How medical frailty is defined, and what evidence an exemption needs. Each of those can be hard-coded into an eligibility system, and each hard-coded assumption is a change request when the rule says something different.

The defensive pattern was to build them as parameters. Look-back periods, verification frequency and exemption evidence rules should sit in tables that policy staff can change and test, not in application code. Notice templates should draw from the same parameters, so a change in rule text does not require a separate rewrite of every letter. This costs more up front. It turns a late rule from a rebuild into a configuration release, and it leaves room for later federal changes or a state’s own policy choices.

There is a governance side as well. Parameter tables need an owner who can approve changes, a test process that checks downstream effects, and an audit trail. Without them, configurability becomes a way to change eligibility policy without anyone noticing, which is its own risk under federal oversight.

Contract now: delivery capacity

Most states run eligibility systems through long-term contracts with a small number of system integrators. Every expansion state faced the same deadline in the same months, alongside other changes in the same law, such as more frequent redeterminations. Integrator teams, test environments and federal reviews of system changes were all finite.

That made spring the time to secure capacity, even with the requirements incomplete. Practical steps included change orders scoped to the statute-fixed work, named staffing commitments for the second half of the year, and early requests for enhanced federal match on the system changes. The vendor pledges announced in January needed the same scrutiny as any discount. A state needed to know what was free, for how long, what it would cost to maintain, and whether accepting it deepened dependence on an incumbent. CMS itself said its list of vendor offerings was not an endorsement and not a determination that any product met federal requirements.

States also needed a credible plan for what would happen if the build slipped. The good-faith exemption gave the federal government a way to allow more time. A state that wanted one would need evidence of effort: dated contracts, test results and a realistic schedule. The same documents serve the state’s own legislature and auditors.

Sorting the work this way did not remove risk. It placed the risk where it was cheapest. Statute-fixed work went ahead, rule-dependent work waited as configuration, and the scarce resource, delivery capacity, was reserved before other states claimed it.

With hindsight

CMS issued its interim final rule on June 1, 2026, with publication in the Federal Register days later and comments accepted through July 31. The January 1, 2027 deadline held. Many of the details landed in the categories above as state choices: how many months to look back, how often to verify, and whether to offer short-term hardship exemptions. States must define medically frail conditions themselves. Summaries of the rule reported that members could attest to an exemption for 2027, with documentation required from 2028, a change states with configurable evidence rules could absorb more easily.

CMS said coverage effects would depend heavily on state implementation choices. That puts the measure we suggested, the share of members verified or exempted from data without contact, at the center of how the policy plays out. Later in this series we return to the data-matching build that followed the rule.