The First H.R. 1 Medicaid Audit Test Arrives October 1—Before the Work Requirements Do

PERM exposure begins long before a federal sample is drawn.

Much of the Medicaid operational attention around H.R. 1 has understandably focused on what arrives in 2027: community-engagement requirements, more frequent redeterminations, and major changes in how states establish and maintain eligibility.

The first major H.R. 1 Medicaid fiscal-control test.

On October 1, 2026, new federal restrictions on Medicaid and CHIP federal financial participation for certain noncitizens take effect.

That date matters not only because eligibility rules are changing. It matters because states must make sure that eligibility status, immigration-status verification, scope of benefits, claims processing, and federal claiming all agree with one another.

That is a different—and potentially more consequential—control problem.

A Medicaid case can look administratively correct while still producing an incorrect federal claim.

That is the October 1 risk.

Section 71109 of the Working Families Tax Cut legislation changes the circumstances under which federal financial participation, or FFP, is available for Medicaid and CHIP coverage of noncitizens.

Beginning October 1, federal matching funds for full Medicaid and CHIP benefits generally become limited to U.S. citizens and nationals and specified categories of noncitizens, including lawful permanent residents, Cuban/Haitian entrants, and Compact of Free Association migrants, subject to other applicable eligibility requirements and statutory exceptions.

CMS has instructed states to treat the statutory change as a change in circumstance for affected current beneficiaries and to complete necessary eligibility redeterminations by October 1.

That alone creates a substantial operational undertaking.

But CMS guidance makes clear that eligibility redetermination is only one part of the implementation requirement.

States also may need to modify eligibility and enrollment systems, Medicaid Management Information Systems, immigration-status verification logic, T-MSIS reporting, financial systems, expenditure reporting, and federal claiming controls. CMS specifically tells states they may need MMIS or accounting edits to prevent federal funds from being claimed for expenditures that no longer qualify for FFP.

That changes the way the October 1 transition should be viewed.

This is not simply an eligibility-policy implementation.

It is an eligibility-to-claiming reconciliation event.

Consider the sequence that has to work correctly:

Eligibility determination → immigration-status verification → benefit classification → claims treatment → claiming code → FFP

Every link matters.

The eligibility system must identify the individual correctly and apply the right immigration-status rule.

The verification process must interpret federal data correctly.

The Medicaid system must assign the appropriate scope of coverage.

Claims and encounter systems must recognize that classification.

Financial systems must place expenditures in the correct federal or state funding pathway.

And the state ultimately must report the expenditure correctly when claiming federal funds.

A mistake at any point can propagate downstream.

An eligibility system might retain a beneficiary under a state-funded coverage policy while the financial system continues treating the person as federally matchable.

A verification interface might return a valid immigration status but the eligibility logic might map that status incorrectly under the new October 1 rules.

An eligibility determination could correctly move someone to emergency-Medicaid-only treatment while an MMIS edit still allows expenditures to flow through a full-benefit federal claiming category.

Or the member's underlying eligibility record might remain largely unchanged while the federal financing status of services provided to that person changes materially.

That last scenario deserves particular attention.

Medicaid organizations are accustomed to thinking of eligibility accuracy primarily as a question of whether a person should or should not have coverage.

October 1 demonstrates why that definition is incomplete.

A person can have a legitimate state-recognized coverage relationship while the federal government is no longer financially participating in the same way.

The eligibility record and the federal claim therefore have to be reconciled—not merely maintained.

The federal guidance is unusually direct.

CMS says states providing state-only funded coverage to individuals for whom FFP will no longer be available for full Medicaid benefits must establish controls that prevent federal claiming beyond allowable emergency Medicaid expenditures. States may need MMIS and accounting-system changes, must be able to isolate Medicaid administrative costs from state-only program costs, and must maintain documentation supporting federal expenditure claims.

CMS also states that it has identified approximately $1.8 billion in questionable expenditures through focused financial oversight involving eight states with state-only funded coverage programs for noncitizens and intends to continue such oversight.

That number should change how Medicaid leaders think about this transition.

The problem is not hypothetical.

The federal government has already been examining whether state expenditures involving populations eligible only for limited federal participation were nevertheless included in federal claiming.

October 1 expands the importance of getting those distinctions right.

CMS additionally directs states to report emergency Medicaid expenditures on the appropriate CMS-64 line and warns that states may risk overclaiming if expenditures for individuals who are not FFP-eligible noncitizens are not reported correctly.

This is fiscal control architecture, not merely eligibility administration.

CMS acknowledges that implementation may require significant Medicaid enterprise-system changes.

Eligibility logic may need to recognize new federal Hub indicators or interpret SAVE immigration-status information differently. State systems may need to distinguish full-benefit eligibility from emergency-Medicaid-only treatment, and CMS explicitly emphasizes alignment between policy teams, technology teams, and vendors.

That creates the familiar risk of a rule being correct on paper but incorrect in production.

For example:

A state policy team can correctly define which immigration categories remain federally matchable.

The eligibility vendor can correctly program most of those categories.

But one mapping table can translate a SAVE response incorrectly.

That erroneous eligibility classification can then feed downstream claims.

The claims system can process those services exactly as designed.

The accounting system can report them exactly as received.

And the state can ultimately submit a technically clean CMS-64 containing expenditures that originated with a single incorrect eligibility mapping.

Every downstream system did its job.

The result can still be wrong.

That is why audit readiness cannot stop with successful eligibility-system testing.

States need to test the entire transaction lineage.

The transition also exposes dependencies outside the state Medicaid eligibility system.

CMS says Section 71109 is expected to affect certain Medicaid beneficiaries receiving Supplemental Security Income. States that rely on Social Security Administration determinations for SSI-related Medicaid eligibility may need to modify their processes, and CMS says certain current SSI beneficiaries must be redetermined before October 1. For new SSI recipients in so-called 1634 states, SSA has been evaluating State Data Exchange changes, with additional implementation information still forthcoming in CMS's June guidance.

This is precisely the type of cross-system dependency that creates audit risk.

Who owns the determination?

Which system owns the immigration-status evidence?

What happens when the external source and Medicaid system do not change on the same schedule?

Which record demonstrates what the state knew on the date eligibility was determined?

And if an upstream federal data feed changes later, can the state reconstruct the evidence actually used in October 2026?

Those are not theoretical documentation questions.

They determine whether a later reviewer can reproduce the original decision.

This is no longer simply a CMS implementation concept.

North Carolina's September implementation materials tell members directly that new noncitizen Medicaid rules begin October 1, while community-engagement requirements and six-month expansion renewals begin January 1, 2027.

That sequencing is useful.

It demonstrates that the first major H.R. 1 Medicaid control transition does not begin with work requirements.

It begins with states having to modify existing eligibility populations and simultaneously make sure that the financial treatment of those populations changes correctly.

The public-facing message may be about who can keep Medicaid.

The operational message is larger:

States must know who is eligible, what coverage they receive, which funding source supports that coverage, and whether every downstream system treats that person consistently.

October 1 therefore presents an unusually valuable opportunity for states to conduct a targeted Shadow PERM review.

Rather than waiting for a federal audit or financial review to reveal an overclaim, states can select affected cases and independently reconstruct the full chain.

For each sampled beneficiary, the review should be able to establish:

Then the state should compare the eligibility result with the financial result.

That final reconciliation is critical.

A traditional eligibility quality-control review can ask:

Was this person eligible?

The October 1 environment requires another question:

Did the state claim the correct amount of federal money for this person's coverage?

Those are related questions.

They are not the same question.

This transition points toward something larger than immigration eligibility.

Medicaid's future audit environment is becoming increasingly interconnected.

Community engagement will depend on payroll, education, benefits, medical, and other external data.

Medical-frailty determinations may depend on claims, encounters, diagnoses, utilization, and clinical information.

Eligibility redeterminations will occur more frequently for important populations.

State-funded coverage can intersect with federally funded Medicaid.

Federal and state systems will exchange more data while statutory rules change more quickly.

That means the traditional boundary between eligibility accuracy and financial accuracy is becoming less useful.

The meaningful control question is increasingly whether the state can reconstruct the complete chain from:

source data → eligibility rule → determination → benefit → payment → federal claim.

October 1 is an early test of that architecture.

The first major H.R. 1 Medicaid audit risk may arrive before the provision receiving the most public attention.

Community-engagement requirements begin later.

The fiscal-control challenge begins October 1.

States have to redetermine affected beneficiaries, verify immigration status correctly, distinguish benefit pathways, modify systems, coordinate vendors and data sources, correctly classify emergency versus full benefits, and ensure that federal claims reflect those decisions.

The central lesson is straightforward:

Eligibility accuracy does not end when the eligibility system reaches the right answer.

The answer must survive every system that uses it.

And the federal claim must tell the same story.

For Medicaid leaders preparing for the next era of PERM, MEQC, program integrity, and federal financial oversight, that may be one of the most important control principles to establish before the larger 2027 changes arrive.

Centers for Medicare & Medicaid Services, State Health Official Letter #26-001, Implementation of Section 71109 “Alien Medicaid Eligibility” of the Working Families Tax Cut Legislation, April 8, 2026. CMS SHO 26-001

Centers for Medicare & Medicaid Services, Implementation Guidance of Section 71109 “Alien Medicaid Eligibility”, June 18, 2026. CMS implementation slide deck

North Carolina Department of Health and Human Services, Know What's Next: Medicaid Changes Starting Oct. 1, 2026, September 1, 2026. North Carolina implementation announcement

About PERM Insights & Perspectives

PERM Insights & Perspectives translates Medicaid eligibility, payment-accuracy, program-integrity, and federal-policy developments into practical operational and fiscal insights for state Medicaid leaders. This Perspective analyzes publicly available federal and state implementation materials and does not constitute legal guidance.