CMS has answered an important question: how approved community-engagement mitigations will be treated in PERM and MEQC reviews. Its November 13 State Medicaid Director letter creates an optional hold-harmless period through June 30, 2027, subject to prior CMS approval. States intending to begin January 1 are asked to notify CMS by December 11, 2026. [1, pp. 2–3]
The protection is consequential. For covered determinations, CMS says they “will not be considered an error” in PERM, MEQC or other CMS eligibility audits. That treatment depends on applications being filed or renewals initiated during the period documented in the approved plan. Other approved community-engagement mitigations receive protection when they are “compliant with the parameters of that plan.” [1, p. 3]
States must continue assessing compliance, exceptions and exclusions. Other eligibility requirements remain in force. CMS describes an opportunity to “test and refine their systems and processes” before enforcement. The option does not postpone all implementation work or authorize every state to stop all eligibility actions. [1, p. 2]
What the three cycles should take from this
CMS's schedule identifies different payment-measurement windows. Those windows identify payments subject to review; they are not the dates on which auditors necessarily begin case assessments. [2, slides 7–8]
CYCLE 1 | Current window: July 1, 2026–June 30, 2027 | Reporting Year 2028
Our assessment: Cycle 1 has the most direct calendar overlap. The first six months of 2027 fall inside its current payment window. For states and individuals subject to community engagement, an approved hold harmless offers an opportunity to identify weak processes while avoiding covered adverse actions and associated errors.
The managerial question is what the state learns during those months. A lower measured error result for a protected category does not, by itself, demonstrate a reliable process. We would still test whether staff identified exclusions correctly, used available data, explained requirements clearly and retained supporting evidence. The protected period can yield a more reliable operation if the state measures its defects rather than allowing protection to hide them.
CYCLE 2 | Next window: July 1, 2027–June 30, 2028 | Reporting Year 2029
Our assessment: Cycle 2 faces the sharpest transition. Its next payment window opens the day after the maximum hold-harmless period ends. Using the full period may be sensible for a state that needs time to correct defects. Waiting until its final weeks to validate those corrections would leave little operational buffer.
We would favor staged readiness gates before July: test the decision logic, exceptions and exclusions, notices, noncompliance procedures and retained evidence; independently retest failures; and establish who owns the transition. The date on the calendar should not substitute for evidence that the process works.
One important qualification: a payment made July 1 is not automatically stripped of protection because it falls in Cycle 2's new window. The letter ties protection to the covered application or renewal and approved plan. PERM methodology also considers the policies applicable when the reviewed eligibility action occurred. Teams must connect payment dates with the underlying eligibility history instead of treating them as interchangeable. [1, p. 3; 3, printed p. 21]
CYCLE 3 | Next window: July 1, 2028–June 30, 2029 | Reporting Year 2030
Our assessment: Cycle 3 has more time between the maximum hold-harmless end date and its next payment window. Its RY2027 window covers July 2025–June 2026, before this community-engagement implementation period. The new option should not be presented as relief for those historical payments. [2, slide 7]
The roughly one-year interval before the next window is useful time for stabilization, not permission to defer implementation. Cycle 3 states can learn from their own early cases and from other states' transitions, then test whether fixes persist through subsequent applications and renewals. A longer runway is valuable only if it produces more dependable operations and evidence.
Should a state use the full period?
There is no single answer for every state, and PERM cycle alone should not determine the choice. Readiness, beneficiary risk, the covered population and CMS-approved plan conditions matter.
In our estimation, the strongest use of this option is a controlled learning period with measurable exit criteria. States should know which defects they are correcting, how they will verify the fix, and when leadership will decide that the transition is ready. Ending early is not automatically a sign of strength. Using the full period is not automatically a sign of failure. The meaningful distinction is whether the time produces verified improvement.
Evidence to retain
For each covered case, we would link the approval and plan version, covered deficiency, applicable dates, application or renewal initiation date, assessment performed and evidence of compliance with the plan. Existing approval registers should connect to case records, not sit apart from them.
The takeaway
The new guidance changes the treatment of covered community-engagement determinations. It also changes the questions leaders should ask. How will the state use the time? What must be working when protection ends? Can it prove that the individual case falls within the approved plan?
For Cycle 1, the immediate opportunity is learning during a protected portion of the current payment window. For Cycle 2, it is a disciplined transition into July 1. For Cycle 3, it is sustained improvement before the next measurement window.
The common task remains: build a process that works, verify it independently and retain the proof.
Editorial update: This letter supplies explicit PERM treatment for covered, approved community-engagement mitigations. It updates our earlier discussion of the unresolved distinction between mitigation approval and PERM treatment. It does not establish blanket protection for unrelated eligibility errors or all federal funding exposure.
Sources
[1] CMS, SMD 26-006, Optional Hold Harmless Period for Community Engagement Implementation, November 13, 2026, especially pp. 2–3. https://www.medicaid.gov/Federal-Policy-Guidance/Downloads/smd26006.pdf
[2] CMS, PERM Overview for Providers, slides 7–8. https://www.cms.gov/files/document/perm-overview-providers.pdf-0
[3] CMS, PERM Manual, printed p. 21 (policy applicable at eligibility action); printed p. 27 (review-period payments can include earlier coverage). https://www.cms.gov/files/document/perm-manual.pdf-2
PERM Insights & Perspectives | Education, not advocacy | perminsights.org
Independent analysis. CMS policy is attributed above; cycle-specific assessments and operational recommendations are PERM Insights' interpretation. Applicable law, exclusions, exceptions and approved state-specific conditions govern individual cases.