The Sands Are Running...

The next CMS Payment Error Rate Measurement report will bring new findings and renewed attention to Medicaid improper payments. But the opportunity to prepare does not begin with its publication.

It is already here.

We know that eligibility requirements are changing. We know that decisions must be supported by evidence that remains available for later review. We know that implementing a correction and demonstrating its effectiveness are separate responsibilities.

The question is what states and their partners will do with that knowledge before the next results arrive—and before subsequent payments enter measurement.

CMS’s reporting-year 2026 schedule calls for improper-payment rates to appear in the November 2026 HHS Agency Financial Report. The underlying payment period is July 1, 2024, through June 30, 2025. The report will describe an earlier operating period, not certify today’s readiness. [1]

The 17 Cycle 2 states are Alabama, California, Colorado, Georgia, Kentucky, Maryland, Massachusetts, Nebraska, New Hampshire, New Jersey, North Carolina, Rhode Island, South Carolina, Tennessee, Utah, Vermont, and West Virginia. [2]

For these states, the release should prompt a comparison between historical findings and current controls. Is the weakness still present? What changed? Which similar cases were examined? What evidence demonstrates that the repair holds?

For other states, the question is equally practical: could the same defect exist in our processes?

Under the current three-year rotation, Cycle 2 returns to reporting in 2029. Its 2026 release is the last scheduled reporting round before H.R. 1’s revised eligibility-related fiscal provisions begin.

CMS identifies October 1, 2029—the beginning of federal fiscal year 2030—as the effective date for provisions changing eligibility-related disallowance requirements and restricting good-faith waiver authority. [3]

That does not make today’s cycle “free.” Existing oversight and financial consequences remain relevant. Nor does a headline error rate establish a state’s eventual repayment amount.

It does make the intervening period consequential. States have an opportunity to identify weaknesses, implement repairs, and accumulate evidence of effectiveness before the next reporting round arrives in a different fiscal environment.

One clock tracks when requirements become operative and decisions must be made. Another tracks when payments enter the period that will later be reviewed.

The reporting date comes afterward.

The following windows are planning projections from the established three-year rotation, subject to confirmation in future CMS cycle instructions. [1, 2]

Cycle 3 has approximately one additional year, and Cycle 1 approximately two, relative to Cycle 2’s later round. That is additional preparation time, not an extension of implementation obligations.

Current reviews also continue. Cycle 1 already has a payment measurement period underway, July 2026–June 2027, for reporting year 2028. [2]

The hourglasses are staggered. The sand is moving in all of them.

Find cycle designations and official state resources in our State & Territory Guide.

States are managing overlapping demands: policy interpretation, verification processes, renewals, exclusions, notices, interfaces, training, vendor delivery, and member assistance. CMS’s redetermination and community-engagement guidance requires work across policy, operations, and systems. [4, 5]

Under that pressure, delivering the minimum functionality needed for implementation can become a practical necessity. But “viable” must include the ability to explain and support the decisions being made.

A system may successfully produce an approval, denial, or request for information. The agency still needs to demonstrate:

These requirements belong in the workplan, budget, vendor deliverables, and acceptance criteria.

Deferring them creates a foreseeable risk: decisions and payments accumulate before the agency can demonstrate their basis. Historical evidence may be difficult or impossible to reconstruct later.

The operational deadline is the first affected decision—not the arrival of the audit.

Our Stop the Error Clock analysis explains why earlier correction matters; From Pay-and-Chase to Prepayment Control examines practical preventive controls.

This concern is supported by existing oversight findings.

GAO’s 2026 review found that CMS accepted PERM corrective-action plans missing required elements, including evaluations of prior corrective actions. GAO also found that CMS did not systematically analyze errors and corrective actions across states and years to assess effectiveness. [6]

That finding gives leaders a concrete assignment: distinguish a correction that has been documented, a correction that has been implemented, and a correction that has been shown to work.

Training delivered, software deployed, or a corrective-action item closed may represent necessary progress. Each still requires an appropriate test of the resulting decisions.

Agencies need identifiable policy versions, effective dates, configurable rules, and retained evidence. They also need a controlled process for changing notices, worker instructions, and system logic when an operative requirement changes.

A later rule should not erase the ability to explain an earlier decision.The calendar may change. The commitment to quality should not.

CMS’s October 21 mitigation checklist offers potential pathways for implementation deficiencies, subject to the applicable authority and approval. States should retain the approved scope, conditions, dates, and evidence of implementation. Mitigation-plan compliance and PERM treatment remain separate questions. Our November 6 special briefing will examine that distinction.

Source: CMS, Proposed State Mitigation and Optional Strategies checklist, p. 1, circulated with the October 21, 2026 state-director email.

MEQC requires state eligibility-review work between PERM reviews. CMS also conducts beneficiary eligibility audits examining determinations and the federal match applied. [8, 9]

Other oversight includes CMS financial and focused program-integrity reviews, HHS-OIG audits, federally required Single Audits, and GAO examinations. These activities have different scopes, schedules, and consequences; they should not be assumed to wait for a state’s next PERM reporting year. [6, 10–13]

Additional runway is time to strengthen the evidence—not permission to postpone it.

PERM’s overall improper-payment measure includes fee-for-service, managed-care, and eligibility components. It is not a fraud rate. Insufficient evidence does not, by itself, establish that a member was ineligible. [14]

An improper-payment estimate, a recovery, and a federal disallowance also represent different measures. Fiscal assessments must identify the governing authority, component, measurement period, calculation, and applicable adjustments.

Operational controls should examine both unsupported approvals and improper adverse decisions. False positives, unresolved exceptions, reversals, and avoidable coverage interruptions belong alongside payment-related measures in the leadership discussion.

Accuracy includes protecting people who qualify.

Select one consequential eligibility workflow and test it.

First, name the owner and define the risk. Bring policy, operations, systems, quality, fiscal, legal, and vendor responsibilities into one documented plan. Identify missing resources.

Next, test decision reconstruction. Select cases that include approvals, adverse decisions, exceptions, and missing-data situations. Ask reviewers who did not make the decisions to reconstruct them from retained records.

Then authorize repairs and independent verification. Give each material defect an owner, a correction deadline, and a verification date. Identify similarly affected cases and safeguards against avoidable coverage interruptions.

Thirty days will not resolve every weakness. It can replace general assurances with documented findings and accountable follow-through.

For the ownership framework, see After the Implementation Plan, Who Owns Accuracy?

97 or Better™—Before 2029 is an educational invitation to make eligibility accuracy a shared industry ambition.

It is not a certification or a claim that a payment-weighted PERM rate directly represents the percentage of people whose eligibility was decided correctly. The ambition is dependable administration: supportable decisions, timely corrections, durable evidence, and protection of eligible members.

CMS’s published schedule places the next results in November; an exact release date has not been confirmed for this article. Between now and that release, what will your agency or organization move forward? Which control will you test? Which evidence gap will you close? Who will verify the result?

We invite states, federal partners, researchers, technology organizations, and community partners to share practical steps and unresolved questions. Those experiences can turn advance warning into shared learning.

We cannot predict every finding. We can act on known weaknesses and test whether our preparations are working.

When the results arrive, one question will concern what the review found. Another deserves equal attention:

What did we do with the opportunity to prepare?

The sands are running. The opportunity to act is now.

Ralph Choate | Founder, Editor & Principal Author
PERM Insights & Perspectives

[1] CMS RY 2026 Cycle 2 kickoff: payment period and November reporting schedule

[2] CMS PERM provider information: cycle assignments and current measurement periods

[3] CMS implementation bulletin: Section 71106 fiscal-year 2030 provisions

[4] CMS eligibility redetermination guidance, SMD 26-001

[5] CMS community engagement resources, including medical-frailty implementation guidance

[6] GAO-26-108017: corrective-action evaluation and oversight[7] Massachusetts Attorney General, October 29 ruling announcement; consult the operative court order and subsequent developments for scope and timing.

[8] CMS Medicaid Eligibility Quality Control program

[9] CMS beneficiary eligibility audits

[10] HHS-OIG: CMS oversight of CMS-64 expenditure reporting

[11] CMS focused state program-integrity reviews

[12] HHS-OIG Medicaid work plan

[13] HHS-OIG explanation of Single Audits

[14] CMS PERM overview: components and interpretation

Source review: October 23, 2026. Future cycle windows are planning projections. Publication and implementation developments may warrant an update.