2027 Is a Dual Eligibility-Control Change, Not a Single Work-Requirement Project

Much of the Medicaid implementation discussion surrounding January 2027 has understandably focused on community engagement.

But that framing risks understating the operational change states are actually facing.

Beginning in 2027, states will not simply add a new eligibility condition for certain Medicaid adults. They will also substantially increase the frequency with which eligibility must be reconsidered for adults in the Medicaid expansion group.

The requirements come from different statutory provisions. They have different technical rules. And the populations they affect overlap without being identical.

Operationally, however, they converge in the same place:

The Medicaid eligibility control environment.

For state leaders, that makes 2027 a dual eligibility-control change—not merely a work-requirement implementation project.

The new federal community-engagement framework generally requires affected Medicaid adults to demonstrate qualifying activity as a condition of eligibility beginning January 1, 2027, unless a state implements earlier. States must assess compliance at application and renewal and may conduct additional periodic verification. When compliance or an exemption cannot be verified, the state must provide notice and a 30-calendar-day opportunity for the individual to establish compliance or show that the requirement does not apply.

Separately, Section 71107 changes the renewal frequency for the Medicaid adult expansion group. For redeterminations scheduled beginning January 1, 2027, states generally must redetermine eligibility every six months rather than annually.

CMS has directly acknowledged the interaction between the two changes. Its implementation guidance notes that many individuals subject to six-month renewals will also be subject to community engagement and that states will need corresponding policy, operational, and systems changes—including community-engagement determinations at scheduled renewals.

That distinction matters.

All affected expansion-group adults face the six-month renewal cycle. Community-engagement requirements apply to a narrower population after federal exemptions, exceptions, and other statutory rules are considered.

But states still have to operate both requirements through largely the same eligibility machinery.

That means more:

The operational story is therefore bigger than work requirements.

It is a significant increase in the number and complexity of eligibility-control events.

Eligibility risk is often discussed primarily as a policy question: Was the right rule applied?

That remains essential.

But volume matters too.

Every eligibility transaction creates another opportunity for a control to work—or fail.

A verification source may not return data.

Two sources may conflict.

An exemption may be coded incorrectly.

A notice may use the wrong reason or effective date.

A member response may arrive but not attach properly to the case.

An automated rule may behave differently from the governing policy.

A manual override may solve the immediate case without preserving enough information to explain the decision later.

None of those failures needs to be dramatic to become consequential.

When transaction frequency increases, small weaknesses can scale.

The risk therefore is not simply whether states can process six-month renewals or perform community-engagement checks.

The more consequential question is whether states can do both repeatedly while preserving the evidence necessary to demonstrate that each resulting eligibility decision was correct and supportable.

Prior PERM Insights work has drawn an important distinction between eligibility accuracy and audit defensibility: a determination may be substantively correct while still being difficult to defend if the contemporaneous record cannot show which authority controlled, what evidence was available, which system rule operated, what exceptions were considered, and what manual actions occurred.

That distinction becomes more important—not less—as transaction volume increases.

A state could reasonably establish one implementation team for six-month redeterminations and another for community engagement.

The statutory requirements are different enough to make that organizational response understandable.

But treating them as separate control environments would miss their operational intersection.

Both depend on many of the same capabilities.

Population identification.
Who is in the expansion group? Who is an applicable individual for community engagement? Who is exempt, excepted, or otherwise outside the requirement?

Data verification.
Which reliable state and federal sources can establish eligibility or community-engagement status without unnecessary member action?

Exception governance.
What evidence establishes an exemption or exception? How long does it remain valid? What happens when later information conflicts with it?

System logic.
Which rule version was applied? What data triggered the decision? What occurred when an interface failed or returned an inconclusive result?

Notice production.
Can the state clearly explain what could not be verified, what the individual must provide, and by when?

Evidence preservation.
Can the underlying source results, attestations, exception bases, notices, and manual actions be retrieved later?

Decision reconstruction.
Can an independent reviewer reproduce why coverage continued, changed, or ended without depending on institutional memory?

Those are not two unrelated sets of controls.

They are elements of one eligibility-control architecture.

CMS is encouraging states to use automation, data integration, real-time verification, and shared technology approaches as they implement community engagement. CMS is also providing technical and delivery assistance to states.

That direction makes operational sense.

States are unlikely to absorb the combined workload through additional manual processing alone.

But automation does not remove the need for auditability.

It changes where auditability must be designed.

For an automated decision, a state should still be able to answer:

What source was queried?

What information was returned?

Which rule operated?

What occurred when the source failed or conflicted with another source?

Which exemption or exception logic was evaluated?

Was there a manual intervention?

What notice was produced?

And what evidence remained in the official record?

The strongest automated eligibility environment is not simply the one that makes decisions fastest.

It is the one that can explain those decisions afterward.

Our existing Eligibility Decision Evidence Standard frames that requirement directly: evidence should be treated as part of the eligibility transaction and preserved through ordinary operations rather than reconstructed after a case has been selected for review.

Traditional implementation testing often asks whether each new function works.

Does the six-month renewal schedule trigger correctly?

Does the community-engagement interface retrieve information?

Does the notice generate?

Does the exception code work?

Those tests are necessary.

They are not sufficient.

The more revealing test is whether the entire transaction can be reconstructed after several controls interact.

Consider a case involving:

a six-month renewal;

community-engagement verification;

an exemption or exception;

an inconclusive data match;

a member response;

and a manual worker action.

Then reconstruct that case from the record alone.

Can a reviewer determine:

If not, the state has identified a readiness problem before an external reviewer does.

That is precisely the purpose of a shadow-PERM approach: use internal sampling and case reconstruction to expose policy, evidence, system, interface, documentation, vendor, and operational weaknesses before they become federal findings.

Community-engagement implementation will create an especially important exception-management challenge.

Exemptions and hardship pathways are sometimes treated operationally as peripheral processing rules.

They are not.

Each exemption is itself an eligibility determination.

It has an authority.

An evidentiary standard.

A duration.

Potential re-verification requirements.

A system representation.

And a downstream coverage consequence.

At scale, inconsistent exemption handling can become a material control weakness.

States should therefore know not only how many people are subject to community engagement, but also:

how many are excluded or exempt;

which evidence pathways establish those statuses;

where manual decisions are concentrated;

which determinations are being reversed;

where data sources conflict;

and whether recurring exceptions expose policy, system, training, or vendor problems.

The earlier PERM control framework developed for this publication identified complex exemptions, manual overrides, retroactive actions, unresolved data-source conflicts, and cases processed during major policy or system transitions as particularly useful targets for deeper internal review.

January 2027 represents exactly that kind of transition.

Community engagement will attract the political and policy attention.

Six-month redeterminations will create the recurring operational workload.

But Medicaid executives should govern the two changes together.

That means:

common governance;

common evidence standards;

common exception management;

common system traceability;

common quality testing;

common escalation;

and common executive ownership of material residual risk.

The practical question for leadership is not merely:

Are we ready to implement Medicaid work requirements?

It is:

Can our eligibility-control environment reliably absorb a higher frequency of renewals, new verification requirements, more exceptions, more notices, and more evidence-dependent decisions beginning in 2027?

Because states will not simply be making different eligibility decisions.

They will be making more decisions, verifying more conditions, more often.

And every additional transaction is another opportunity to demonstrate that the control environment works—or to discover that it does not.

Sources