On September 8, 2026, the Electronic Frontier Foundation published 1,000 pages of internal CMS documents obtained through a federal lawsuit filed six months earlier. The documents reveal the inside operation of WISeR, a prior authorization AI model that launched January 1, 2026, and now governs Medicare prior authorization across six states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington.
The core finding is structural rather than technical. Vendors operating WISeR are paid 10 to 20 percent of what CMS calls "averted expenditures," the official term for claims they deny. The documents show what happens when that incentive structure meets real patients waiting for real care.
What WISeR Is and How It Operates
Prior authorization is the process by which a payer reviews a provider's request for a service before agreeing to cover it. For decades, that review was done by human reviewers applying clinical guidelines. WISeR replaces human reviewers with an AI model for 13 elective services in its first year, with a planned expansion to air ambulance, cancer treatment, MRI, and emergency services running through 2031.
The six states in the initial deployment account for a significant share of total Medicare enrollment. Providers in those states now submit prior authorization requests not to a human reviewer but to one of the AI vendors operating under the WISeR contract. Those vendors review the request, apply the model, and return a decision within what CMS committed would be a 72-hour window.
In theory, AI prior authorization should be faster and more consistent than human review. Algorithms do not have bad days, do not develop backlogs the same way human teams do, and can apply clinical guidelines uniformly across thousands of simultaneous requests. These are genuine advantages, and they explain why AI-driven prior authorization has attracted interest from both commercial and public payers.
The documents the EFF obtained reveal the gap between that theory and what the WISeR program produced in its first year.
The Incentive Structure That Explains Everything
The financial model underlying WISeR is the key fact from which everything else follows. CMS contracts with vendors to operate the prior authorization review function. Those vendors are paid a share of "averted expenditures," the bureaucratic term for claims that were denied rather than approved.
The payment rate is 10 to 20 percent of the denial value. A vendor that denies a $5,000 orthopedic procedure earns $500 to $1,000 from that single denial. A vendor that approves the same procedure earns nothing from that transaction beyond its base contract rate.
Quality scores are built into the vendor contracts as a mechanism to counteract excessive denial. But the quality penalty is modest: poor performance reduces vendor payments by only 5 to 10 percent. Against a 10 to 20 percent payment for denials, a 5 to 10 percent quality reduction creates a weak incentive to approve borderline cases. The arithmetic favors denial.
This is not a cynical reading of an otherwise sound structure. It is the straightforward prediction of basic incentive economics. When you pay someone more for saying no than for saying yes, and the penalty for saying no too often is smaller than the reward for saying no, you should not be surprised when they say no more than the clinical evidence warrants.
20,000 Denials in the First 90 Days
The documents show that in the first three months of WISeR's operation, two vendors denied more than 20,000 prior authorization requests combined. For a program covering 13 elective services across six states, that volume suggests denial rates were high from the very beginning.
One vendor, Virtix, denied more prior authorization requests than it approved during the same period. CMS eventually placed Virtix on a Corrective Action Plan, the agency's mechanism for addressing vendor non-compliance. The plan acknowledges that Virtix's performance fell outside acceptable parameters as defined in its CMS contract.
The Corrective Action Plan is a paper remedy for a patient care problem. It does not restore access to care for the patients whose requests were rejected during the period when Virtix was operating outside acceptable parameters. It does not compensate providers who submitted requests, received denials, and had to navigate appeals or seek alternative care pathways. It signals that CMS recognized the problem, after the fact, with a mechanism designed to correct future behavior rather than address past harm.
The 83-Day Wait
CMS's 72-hour response commitment was one of WISeR's central design features. Fast decisions mean faster access to care when requests are approved, and faster ability to appeal or seek alternatives when they are rejected. A 72-hour commitment is not particularly ambitious for AI-driven review: a well-configured system can process most requests in minutes, not hours.
Page 234 of the EFF document release describes a single prior authorization request that went unanswered for 83 days. That is 1,992 hours against a 72-hour commitment. The patient connected to that request waited nearly three months for a decision CMS promised would take three days.
The document does not specify what happened to that patient during the 83-day wait. It does not say whether they received care through an emergency pathway, went without the procedure, paid out of pocket, or saw their condition change materially during the delay. What it shows is that the 72-hour commitment was not a floor the program reliably met: it was a target the program failed, in at least one documented case, by a factor of more than 27.
The chart above illustrates the scale of that gap. The 72-hour promise against an 83-day reality. The space between them represents weeks of pain, uncertainty, and delayed access to care for a Medicare beneficiary who was told the system would respond in three days.
Patients at the Bedside
The provider testimonies embedded in the EFF documents are among the most significant material in the release. They document what WISeR produced at the level of individual patient encounters, in language that aggregate statistics cannot convey.
"Patients crying in pain" while waiting for WISeR decisions on kyphoplasty procedures. Three patients at the bedside in tears, unable to receive treatment their providers had already determined was medically necessary.
Kyphoplasty is a minimally invasive procedure for vertebral compression fractures, which are among the most common fractures in Medicare-age patients with osteoporosis. The procedure involves inserting a small balloon into a collapsed vertebra to restore height, then injecting bone cement to stabilize the fracture. For patients with acute compression fractures, the pain before the procedure can be severe, immobilizing, and resistant to non-invasive management.
When a provider submits a prior authorization request for kyphoplasty and WISeR does not return a decision within 72 hours, the provider faces a clinical choice: continue waiting while the patient remains in pain, navigate an emergency appeal process, or find a way to deliver care outside the authorization framework. For patients without resources to self-pay or the clinical profile to qualify for emergency exceptions, waiting is often the only option.
The testimonies in the documents do not read like statistical summaries. They read like accounts of specific encounters with specific people: the provider who documented patients crying in pain, the provider who recorded three patients at the bedside in tears. These are clinical records of the human cost of administrative delay built into a program designed, according to CMS, to manage Medicare spending more efficiently.
Vendor Failures: Virtix and Innovaccer
The Virtix Corrective Action Plan is the more visible of the two documented vendor failures in the EFF documents. The Innovaccer situation in Ohio may be more instructive about the systemic oversight problems the documents reveal.
According to the documents, Innovaccer launched WISeR operations in Ohio without completing adequate pre-launch testing. The system began operating in auto-affirm mode: it approved every prior authorization request that came through without actually reviewing the clinical basis for the request. The prior authorization review function, the entire purpose of the program, was not occurring.
Auto-affirming is not a suboptimal version of prior authorization review. It is the complete absence of it. For whatever period Innovaccer was operating in Ohio in auto-affirm mode, Medicare beneficiaries and their providers were submitting requests to a system that processed them without applying any clinical criteria to the underlying documentation.
The documents note that CMS became aware of the situation and Innovaccer corrected the configuration. They do not specify how long the auto-affirm period lasted, how many requests were processed in that state, or what happened to patients whose care was initially approved during the auto-affirm period and might have been reconsidered once the system was corrected.
Together, the Virtix and Innovaccer failures reveal a program where vendor oversight mechanisms were insufficient to catch serious operational problems before they reached the patient care level. Corrective Action Plans and configuration corrections are evidence that CMS responded to the failures it discovered. They are not evidence that the oversight structure was designed to prevent those failures from occurring in the first place.
The Congressional Response
Senator Maria Cantwell was among the first congressional voices to respond publicly to the EFF document release. She described WISeR as a "denial device" in public statements and called for the program to be shut down pending a comprehensive review of its outcomes, governance structure, and vendor incentive alignment.
Democratic members of the House and Senate introduced legislation to block WISeR's continued operation and prevent its expansion to additional services. The legislation specifically names the vendor incentive structure, the payment of a percentage of denial values, as incompatible with a program whose stated purpose is to ensure that Medicare beneficiaries receive medically necessary care.
The political path for that legislation is difficult. CMS is an executive agency, and the administration that authorized WISeR has not signaled it intends to respond to the shutdown calls with urgency. What the September 8 document release has produced is a specific, documented evidentiary foundation for congressional oversight requests, appropriations conditions, and regulatory pressure that was not previously available to WISeR's critics.
What WISeR Reveals About AI Governance in Healthcare
The WISeR documents are important not only as an account of what happened in one program in one year. They are a case study in a failure mode that will recur in healthcare AI if the governance frameworks around AI deployment do not evolve to address it directly.
AI prior authorization is becoming standard in healthcare, not experimental. Commercial payers are deploying similar systems. The technology is spreading, and the governance question that WISeR raises most clearly is not whether AI can make accurate prior authorization decisions. It is: who benefits financially from errors in which direction?
An AI system designed to support clinical decision-making succeeds when it helps providers identify the right care. Its financial incentives should align with accuracy: getting the right answer for the patient, not the cheapest answer for the payer. An AI system that automates denial decisions and is paid a percentage of what it denies has a financial incentive to err toward no.
CMS built into WISeR a quality penalty mechanism designed to counteract excessive denial. The mechanism was a 5 to 10 percent payment reduction for poor quality scores. Against a 10 to 20 percent payment for denials, that penalty was insufficient. The WISeR documents are, in significant part, a record of what happens when the deterrent for over-denial is smaller than the reward for denial.
The lesson for healthcare AI governance is specific and actionable: when AI systems make decisions that affect patient access to care, the financial incentives of the entities operating those systems must be designed to align with accurate, patient-centered outcomes. That alignment cannot be assumed from technical accuracy metrics alone. It must be built into the financial structure, monitored through outcome data, and enforced when performance deviates from acceptable ranges.
What Comes Next
CMS has not publicly responded to the EFF document release or the congressional calls for WISeR shutdown as of September 14, 2026.
The Democratic legislation to block WISeR faces a difficult path in the current Congress, but its introduction creates a formal record that enables future oversight mechanisms and appropriations conditions.
Senator Cantwell's public statements signal that at least some members of Congress view WISeR as a priority issue for the current legislative session.
The 1,000 pages of CMS documents are now in the public record. Provider advocacy organizations, patient groups, and healthcare AI researchers are beginning to analyze the full release.
WISeR is scheduled to expand its covered services through 2031. Whether that expansion proceeds, and under what governance conditions, will depend in part on how CMS responds to the documented failures in the program's first year.
The Bottom Line
The 1,000 pages the EFF released on September 8, 2026 are not a verdict on AI in healthcare. They are a detailed, documented account of what happened when one AI prior authorization program launched with a financial structure that rewarded denial over accuracy.
The patients who waited 83 days for a 72-hour decision, the providers who watched patients cry at the bedside waiting for kyphoplasty approvals, the 20,000 requests in the first 90 days of a program with limited real-time oversight: these are not abstractions. They are documented outcomes of specific policy choices about how AI systems are governed and how their vendors are compensated.
If you work in healthcare as a provider, administrator, payer, investor, or policymaker, WISeR is a case study that deserves your attention. The questions it raises about AI governance, vendor accountability, and patient protection are not unique to CMS or to this program. They are the questions that will define how AI enters the clinical environment for the next decade.
Oatmeal Health covers healthcare AI, policy, and investment every week. Subscribe below to stay current on what is actually happening, beyond the press releases.