760,000 people just lost their ACA coverage in one week.
The government calls it a fraud crackdown. And by the numbers, it is. CMS canceled approximately 315,000 unauthorized enrollments in the Federal Health Insurance Marketplace, covering more than 760,000 individuals. The agency expects to recover roughly $2.2 billion in taxpayer-funded subsidies.
Those are extraordinary numbers. The largest single enforcement action against Marketplace fraud in recent memory.
But the number that keeps me thinking isn't the $2.2 billion. It's the 760,000 people who woke up last week without health insurance and had to figure out what just happened to them.
That's the story worth unpacking.
What CMS Actually Did
On September 22, 2026, CMS announced a sweeping enforcement action targeting unauthorized ACA Marketplace enrollments. Here's the breakdown:
The scale of cancellations:
315,000 unauthorized policies canceled
760,000 individuals affected
$2.2 billion in premium subsidies to be recovered
Effective date: August 31, 2026 (announced three weeks later)
440,000 additional enrollees flagged for ongoing investigation
The enforcement actions against brokers:
Over 200 non-compliant agents and brokers terminated since January 2026
569 notices of intent to terminate issued this summer to brokers who submitted 2026 applications without key applicant information, including Social Security Numbers
66 terminations already finalized from the first 100 respondents; 469 additional notices pending
Temporary moratorium placed on new agent and broker registrations for the 2027 plan year, expected to run through February 1, 2027
New system requirements:
All agents and brokers must re-verify their identities through Login.gov or ID.me
Applications must now include Social Security Numbers or immigration document numbers for all non-newborn applicants
Consumers must electronically authorize agent and broker activity before those parties can act on their behalf
System changes now prevent agents and brokers from accessing consumer-only applications
Note: the moratorium applies to the 30 Federally-Facilitated Marketplace states but excludes web brokers and state-based exchange registrants
CMS Administrator Dr. Mehmet Oz put it bluntly: "Every dollar lost to fraud is a dollar taken from hardworking taxpayers and the Americans these programs are intended to serve."
HHS Secretary Robert F. Kennedy Jr. added: "We are shutting down unauthorized Marketplace enrollments and returning approximately $2.2 billion in taxpayer-funded subsidies."
The political framing is clear. But the operational picture is more complicated.
How the Fraud Actually Worked
To understand why this happened, you need to understand the incentive structure that bad actors exploited.
ACA Marketplace enrollments come with federal premium subsidies - the Advanced Premium Tax Credits (APTCs) that make coverage affordable for millions of Americans. When a broker enrolls someone in a plan, that broker earns a commission. The subsidy flows to the insurance carrier; the commission flows to the broker.
For a certain class of fraudulent actor, this created an obvious scheme:
Enroll real people (often without their knowledge or consent) in Marketplace plans. Collect commissions. The subsidy gets paid. The broker gets paid. The person enrolled had no idea.
The mechanics varied. Social media ads promising a "$6,400 subsidy" or free cash for groceries and rent. No legitimate ACA program provides direct cash payments - but plenty of people clicked. Once a consumer handed over their personal information, bad actors could complete the enrollment process, attach themselves as the broker of record, and collect commissions.
Some affected individuals were switched from their existing plans into different plans without authorization - often plans with higher subsidies attached, and therefore higher commissions. Consumers discovered this only when they tried to use their coverage or saw the wrong plan name on their insurance card.
CMS's own analysis found that agents and brokers who first registered for the 2026 plan year represent a small fraction of all agent and broker-assisted enrollments - but account for a disproportionate share of unauthorized enrollments. The commission economics tell part of the story: an estimated $71 to $98 million in broker commission revenue is expected to shift from newly-registered brokers to established ones as a result of this enforcement action.
This is the structural tell: new entrants, low barriers to registration, high subsidy volume. When you build enrollment infrastructure at speed and scale without tight identity verification upfront, you create attack surfaces. Bad actors found this one fast.
This Isn't the First Time
What makes this enforcement action notable isn't just its size. It's what came before it.
Between June and October 2024, CMS suspended 850 brokers for suspected fraud. Every single one of those brokers was eventually reinstated.
The Government Accountability Office issued a sharply critical report saying that years of warnings about Marketplace fraud had not produced adequate fraud protections. The warnings were there. The systemic response wasn't.
CMS has now established a new FFE (Federal Facilitated Exchange) anti-fraud coordination group that spans CMS and HHS leadership, with regular coordination meetings to sustain enforcement going forward. Whether that group produces durable change or becomes another line item in the next GAO report remains to be seen.
What we know is this: the fraud that led to 760,000 people losing coverage wasn't sudden. It built up over years of structural gaps. September 22 was the moment the agency decided to address those gaps by canceling the enrollments that came through them.
Deep Dive: The Data Behind the Enforcement
The CMS enforcement was not arbitrary. The agency released specific risk-ratio data that explains which brokers triggered the enforcement criteria.
New agents and brokers who registered for the first time in 2026 showed statistically elevated fraud risk indicators across every measured dimension:
2.8 times more likely to have unresolved income verification issues
2.7 times more likely to be missing Social Security Numbers on applications
2.6 times more likely to have unresolved citizenship or immigration status verification
1.6 times higher Special Enrollment Period misuse rates
1.4 times higher Medicaid denial attestation rates
1.4 times higher dual enrollment rates
These aren't marginal differences. They represent a structurally distinct risk population that moved through the enrollment system because the system hadn't built the gates to stop them.
Analysts estimate that $71 to $98 million in broker commission revenue will shift from newly-registered agents to established ones as a direct result of this enforcement. That's real money for a concentrated population of bad actors who had a brief window of opportunity before CMS closed it.
The 440,000 additional enrollees currently flagged for investigation suggest this enforcement action is not finished. More cancellations are possible before 2027 open enrollment begins.
The geography of impact
The 760,000 people who lost coverage are concentrated in states that use the federal Marketplace platform (HealthCare.gov) - 30 states in total. States with their own exchange platforms (California, New York, Massachusetts, and 14 others) are not directly affected by this action, though several have announced their own broker oversight reviews in response.
Within the affected states, the populations most likely to have been targeted by fraudulent brokers were lower-income households eligible for high APTCs, households that used broker-assisted enrollment, and households that had recently changed plans through mid-year Special Enrollment Periods. These are also the populations least equipped to navigate a sudden coverage loss and least likely to know about appeal rights or corrected 1095-A procedures.
Who Is Actually Affected
If you work in healthcare operations or policy, you need to understand who this action reaches - and who it doesn't.
Affected: Individuals enrolled through the Federal Health Insurance Marketplace (HealthCare.gov). This includes residents of states that use the federal platform.
Not affected: State-run exchanges. Residents of states with their own marketplace platforms are not impacted by this specific action.
That distinction matters for hospital systems, FQHCs, and health plans with significant ACA membership. If your patient population is concentrated in HealthCare.gov states with high broker-assisted enrollment rates, your revenue cycle team needs to be checking coverage eligibility right now - not at the next billing cycle.
Who within the 760,000 is at greatest risk:
There are essentially three groups caught in this enforcement action:
People enrolled without their knowledge or consent - fraud victims in the purest sense
People switched into different plans without authorization - often discovering this when their medications or providers changed
People who used legitimate brokers but whose applications contained errors or missing information that triggered the enforcement criteria
Groups 1 and 2 were victimized by fraudulent brokers. Group 3 is collateral damage - real people with legitimate coverage needs who may have done nothing wrong and still lost their insurance.
CMS has not released detailed data on the breakdown between these groups.
The $2.2 Billion Isn't Actually Recovered Yet
A note on the headline number that deserves more scrutiny.
CMS says it "expects" to recover $2.2 billion. That's not the same as having recovered it.
The subsidies (APTCs) were paid to insurance carriers on behalf of enrollees. Recovering them requires clawing those funds back through a reconciliation process - which takes time, generates disputes, and doesn't always recover the full amount.
There's also a tax liability dimension that affects individual consumers. Starting with the 2026 plan year, the caps on how much excess subsidy a person must repay have been eliminated. For individuals who received unauthorized subsidies attached to plans they didn't know they were enrolled in, this creates a real exposure: they may receive corrected 1095-A forms and face unexpected tax bills.
CMS has said affected individuals should request corrected or voided 1095-A forms and file appeals within 60 days of discovering the fraud. Free Navigator programs are available to help.
But "free navigator programs are available" is not the same as "every affected person will successfully navigate this." Many of the 760,000 don't know yet that they've been affected. Many won't know until open enrollment, when they try to re-enroll and discover their history.
The Question Nobody Is Asking
Here's what I keep coming back to.
The CMS framing is simple: fraud happened, we stopped it, we're recovering taxpayer money. That's a clean story.
The messier story is this: among the 760,000 people who lost coverage, how many were genuinely sick? How many were in the middle of cancer treatment, managing a chronic condition, relying on medications they now can't afford?
Losing insurance isn't a neutral administrative event. It has real consequences in the real world.
We know that coverage disruptions are associated with delayed care, increased emergency department use, and worse health outcomes. We know that the populations most likely to use broker-assisted enrollment are also often the populations with the least capacity to navigate a sudden coverage loss: lower income, less health literacy, greater dependence on the coverage they thought they had.
The answer to "how many of the 760,000 were real patients caught in someone else's fraud scheme?" is: we don't know. CMS hasn't said. And that number would tell us a lot about how to weight the benefit of the $2.2 billion recovery against the cost of the enforcement action itself.
I'm not arguing against enforcement. Fraud in healthcare coverage erodes trust in the entire system, and that trust is already thin. Enforcement matters. The structural fixes CMS is implementing - identity verification, electronic consumer authorization, SSN requirements - are the right interventions.
But the people harmed by the fraud are also the people harmed by the enforcement. That duality deserves more attention than it's getting.
What Changes for 2027 Open Enrollment
If you're a broker, a navigator, an employer offering ACA-compliant coverage, or a health system with a patient population on ACA plans, here's what you need to know about November 1, 2026.
For brokers and agents:
Full re-identity verification through Login.gov or ID.me is required. If you haven't completed this, you cannot register for 2027 plan year enrollments.
If you didn't have an active Exchange Agreement for 2026, the moratorium applies to you - you cannot register for 2027 at all under the current rules. The moratorium is expected to run through February 1, 2027.
Electronic consumer authorization is now a hard requirement before you can act on any application. No authorization, no action.
Web brokers and state-based exchange registrants are exempt from the moratorium - but are not exempt from the new verification and authorization requirements.
For consumers:
Verify your current enrollment at HealthCare.gov before November 1. Check the plan name, the broker of record, your income information, and your 1095-A.
If anything looks wrong, call the Marketplace Call Center at 1-800-318-2596. Document the call with date, time, and reference number.
Verify your coverage before any medical appointments or pharmacy visits. Eligibility databases don't always update instantly.
Be extremely skeptical of any outreach promising specific dollar amounts from ACA plans. No legitimate enrollment assistance promises cash.
If you received a corrected 1095-A, file an amended return or contact a navigator for help. Tax liability from unauthorized enrollments is a real risk.
For health systems and payers:
Run eligibility checks now on your ACA-enrolled patient population, especially in HealthCare.gov states.
Identify patients who may have lost coverage effective August 31 and are now uninsured but haven't been notified.
Brief your revenue cycle team on the 1095-A correction process and what it means for retroactive billing.
Update your charity care screening protocols to account for patients who may have thought they were insured and weren't.
For policy-focused operators:
Watch the GAO follow-up. The agency that warned about this problem years before it exploded will audit whether the September 22 response was proportionate and whether the structural fixes hold.
Watch the 440,000 flagged enrollees. A second wave of cancellations before November 1 is possible.
Watch the state exchange response. Massachusetts, New York, and California have large state exchanges - expect them to audit their own broker oversight in the next 60 days.
The Structural Fix and Its Limits
CMS's new requirements - identity verification, electronic authorization, SSN requirements - are the right interventions. They close the specific vulnerabilities that bad actors exploited.
But they also raise the barrier for legitimate enrollment assistance. Brokers who served rural, elderly, and non-English-speaking populations - populations where assisted enrollment is most critical - now face additional compliance burdens. Some will exit the market.
This is the tradeoff that the $2.2 billion headline doesn't capture. Tightening fraud controls in enrollment programs tends to reduce both fraudulent enrollments and legitimate ones. The magnitude of that effect depends on implementation quality, navigator program funding, and whether CMS pairs the enforcement with an equally aggressive outreach effort to help legitimate consumers re-enroll.
So far, the outreach has not matched the enforcement in volume or urgency.
The 760,000 people who lost coverage need to know about it, need to know how to appeal it, and need to know what their options are before they show up at a provider without coverage they thought they had. CMS announced the enforcement on September 22. Open enrollment starts November 1. That's five weeks.
What This Means for You
If you run a healthcare organization: The enrollment fraud that CMS just cleaned up affected your patients. Check your ACA-enrolled patient population now. Identify who may have lost coverage. Adjust your revenue cycle and charity care workflows accordingly.
If you're in healthcare policy: The $2.2 billion is a data point. The 760,000 people are the policy problem. The enforcement was necessary. The question is whether the structural fixes will hold, and whether the patients caught in the middle get adequate support.
If you work with brokers or manage a brokerage: The identity verification requirement is now. Re-enrollment moratoriums are real. Get your compliance documentation in order before November 1.
If you're a patient or consumer: Log into HealthCare.gov and verify your enrollment today. Not next week. Today.
Fraud in healthcare coverage erodes trust. And trust in healthcare is already running thin.
The enforcement was necessary. The system design failures were real. The $2.2 billion in recovered subsidies matters.
But so do the 760,000 people who lost their coverage last week. Some of them needed it. Some of them are sick. None of them had a hand in the fraud that took it away.
Enforcement without a parallel commitment to making whole the people who got caught in the middle isn't just incomplete. It's a policy failure waiting to be written about in the next GAO report.
This one is worth watching.
Key References
CMS Press Release, September 22, 2026: "CMS Cracks Down on Fraud, Waste, and Abuse in the Federal Health Insurance Marketplace" - cms.gov
CMS Fact Sheet: Federal Marketplace (FFE and SBE-FP) Anti-Fraud Actions - cms.gov
ASPE Issue Brief, June 2026: "ACA Exchange Enrollment in 2026" - aspe.hhs.gov
Morgan Lewis Analysis, September 2026: "CMS Cancels Marketplace Enrollments and Imposes Moratorium on New ACA Broker Registrations" - morganlewis.com
Groom Law Group Analysis, September 2026: "CMS Targets Unauthorized Marketplace Enrollments and Broker Misconduct" - groom.com
U.S. Government Accountability Office: Prior reports on Marketplace fraud protections (2023-2025) - gao.gov
Jonathan Govette is CEO of Oatmeal Health, an AI company focused on lung cancer early detection. He writes The Oatmeal Bite, a daily healthcare newsletter covering policy, operations, and strategy.
The detail about people being enrolled without knowing it is the part I'd underline. If you have Marketplace coverage, log into your own account before open enrollment and check the plan, the income on file, and any agent listed. It takes five minutes and it's the simplest way to catch a change you never asked for.