2.3 Million Reasons to Rethink Member Communications Before January 1

On June 1, 2026, the Centers for Medicare & Medicaid Services (CMS) issued an interim final rule implementing the 2025 reconciliation bill's new statutory requirement that certain adults in Medicaid complete 80 hours per month of work or a qualifying activity as a condition of eligibility.¹ States may delay the verification component by a year, but Arkansas, Idaho, Indiana, Iowa, North Carolina, North Dakota, Ohio, and Utah have already signaled they will impose rules stricter than the federal floor starting January 1, 2027.⁷ The rule nationalizes work requirements for every Medicaid expansion program and builds upon, and further restricts, the earlier state experiments in Arkansas and Georgia.

Of the roughly 2.3 million people projected to lose coverage in 2027, about four in ten are expected to lose it to administration and paperwork rather than to noncompliance.¹ This is a striking estimate, especially given that nine in ten adults subject to these requirements already work or would qualify for an exemption.² The coming losses are not primarily a story about work. They are a story about whether information can travel between a state, a plan, and a member: twice, in both directions, and on a deadline.

Arkansas has already shown what happens when it cannot. Beginning in 2018, the state required adult Medicaid recipients aged 30 to 49 to work or engage in community activities 80 hours a month. In less than a year, more than 18,000 lost coverage.³ A 2019 review by the Arkansas Center for Health Improvement traced the losses to administrative failure: difficulty contacting enrollees, confusion over what was required, and trouble navigating the state's online reporting portal.⁴ More than 75 percent of those required to report failed to do so in any given month, and nearly all of them logged zero qualifying activities: the signature of a reporting failure rather than a work failure.⁵ The consequences followed people out of the program: 50 percent reported serious medical debt, 56 percent delayed care, and 64 percent delayed medications because of cost.³

Arkansas tested only the reporting of work, not the clinical questions the new rule adds. The 2026 rule requires documented proof that a medical condition prevents a recipient from meeting the hours requirement, and early adopters already show how differently states will handle it: Nebraska has issued a condition list tied to ICD-10-CM chapters; Montana offered a plain-language clinical framework; and Idaho and Indiana did not offer any guidance beyond the rule itself.⁷

Who is actually at risk: three populations, three kinds of work

CMS provided an exemption framework that states can build on it, so determinations will vary state-to-state. Plans do not need to wait for implementation to estimate which of their members are likely or unlikely to qualify for exemptions, and tailor support accordingly.

Likely exempt: Conditions clearly within the five medical-frailty categories outlined in the rule or a state's list (e.g., ALS, multiple sclerosis, schizophrenia). Plans should ensure that the exempting condition is on file and available to providers before a member is deemed noncompliant.

Acuity-dependent: Conditions that may qualify depending on severity (e.g., anxiety or asthma). This is plans’ highest-touch population, and the one verification notices will actually reach, so the plans should work to engage members through multiple channels.

Not likely exempt: Conditions outside the frailty categories (e.g., diabetes, hypertension, ADHD). The plan's work is to protect members’ coverage (in Arkansas, it was precisely these members who lost coverage due to paperwork issues). Members need clear confirmation of what to report, when, and how.

Arkansas's communication failures were visible in advance: Unverified addresses, an unsuited reporting channel, unusable notices, and a deadline that was not clearly communicated. None of these issues required federal guidance to prevent in the future.

The three-notice cadence

Every state program must run these three federally mandated communications. What a plan layers around each one decides who keeps coverage.

For the federal work requirements soon to be implemented nationwide, the state's education notice is the starting line for members. But a plan can mark the course and set up the water stations before the race even starts. That readiness rests on a foundation of six principles.

Own the save.

States own eligibility, but plans own the relationship with members, meaning that the plan's outreach is the safety net that tries to help members from hitting the state's legal floor. Arkansas's notices met the legal standard, yet more than 18,000 people lost coverage because the gap between legally sufficient and functionally effective was no one's job to close. Closing it starts with governance: one accountable owner, a cross-functional team, and a standing executive number reported monthly. Plans will not always see why a state disenrolled a member, so build the measure from what the plan can see: losses among members who never responded, whose mail came back, or who received a verification notice. Someone must own that number, and rescue outreach should be budgeted as retention spend: every member lost to paperwork is a re-acquisition cost and, in time, a sicker return.

Treat deliverability as the first communication metric.

Before considering communications response rates or even before comprehension, states need to ask themselves: Did the letter even make it to members? Comprehension is the destination, but nothing can be understood if never arrives. Roughly a third of Arkansas members had changed phone or address,³ and by one account as few as 10 to 15 percent of first-class mailings reached their targets.⁴ The remedy is unglamorous but available now: full-file address cleansing and National Change of Address processing, coupled with a structured process for validating, documenting, and submitting updated contact information to the state eligibility system where required; an address-confidence score that flags the first at-risk segment; barcode-level tracking; and a 48-hour clock that turns every returned piece into an outreach task instead of an archive line. States increasingly treat plan-submitted contact information as a reliable data source for eligibility and renewal, meaning that this work will be integrated into state Medicaid agency’s workflows. Mature programs report up to a 50% reduction in return mail and a 40% improvement in first-touch delivery within six months.⁶

Build more than one door.

In Arkansas, the only way to report was via an online portal, but only 11.3 percent of their members preferred reporting online.³ One door became a single point of failure. Plans cannot control how states build the reporting process, but they can advocate for a multichannel intake system that incorporates phone, paper, and in-person options alongside an online portal. Plans can also control their own front door, building one compliant omnichannel system that fits members’ needs and preferences, with email, text, portal, and paper as one escalating sequence. Valid digital consent takes months to accumulate (the longest-lead item in the build), so every touch should capture preference today. And digital delivery costs up to 80% less than print,⁶ funding the live outreach the rescue window demands.

Engineer notices like compliance documents; write them like consumer communications.

A regulated notice is both a legal instrument and a consumer communication. It must satisfy the auditor and survive a kitchen counter. Arkansas's notices were written at an eighth-grade level, while the national average for health-literacy is fourth to sixth grade;⁴ the notices met the legal standard but missed their readers. Plans preparing their communications should inventory every artifact the requirement touches, rewriting each to a tested fourth-to-sixth-grade level, putting the action, deadline, and consequence in the top third of page one, translating for threshold languages, and remediating everything digital to Section 508 standards. Accessibility failures are silent non-delivery to precisely the members most likely to be exempt.

Prove it arrived.

For the state's regulated notices, adequate delivery is a legal requirement. Plans’ outreach carries no such mandate, which is exactly why proof of arrival matters there. It is how a plan ensures that no member slips through the cracks between the state's process and the plan's safety net. In Arkansas, no one could show what had reached members, so non-receipt looked like noncompliance. Tracking closes that gap twice: a failed communication triggers the next touch instead of silence, and one member-level record, print and digital together, answers the question every review eventually asks: What did we send this member, on what date, and did it arrive?

Run the 30-day window as a funnel, not a deadline.

Most Arkansans who missed their renewal window never knew it was open, while only 11% who lost coverage ever regained it.⁵ Reenrollment either happens inside the window or, for most members, never. The funnel needs to be built and approved before go-live: a day-zero multichannel alert, escalating reminders, segment-specific help by day ten, a live call by day twenty, and last-chance outreach in the final week, triggered in real time by state files, data-matching failures, and returned mail. The success of the program can be measured by one the rescue rate, or the share of noticed members who keep their coverage.

Engaging a funnel does not need CMS or judicial input. Addresses can be cleaned, consent captured, templates rewritten, tracking instrumented, and playbooks approved right now. The states will decide what the rules are, and Arkansas has already decided what failure looks like. What a plan does in between will decide which of its members remain covered in 2027.

Two vantage points, one problem

This is a joint point of view because the problem is a joint one. Which members have state exemptions is inseparable from whether the notice reaches them and is understood; the policy and operational questions will decide 2027 together. We wrote from two vantage points: policy and strategy (Avalere Health), the operational front lines of member communication (Command Direct). The plans that fare best next year will be the ones that have those conversations together to craft an effective solution.

Eric Levine, M.P.H., is a principal at Avalere Health. Michael Lutz, MBA, is a managing director at Avalere. Laura Massetti is chief growth and marketing officer for Command Direct.

Notes

1. CMS. “Medicaid Community Engagement Requirement for Certain Individuals Interim Final Rule with Comment Period (CMS-2454-IFC).” June 1, 2026.

2. KFF. “Understanding the Intersection of Medicaid and Work.” Analysis of Medicaid adults subject to community engagement requirements.

3. Sommers BD, et al. “Medicaid Work Requirements in Arkansas: Two-Year Impacts on Coverage, Employment, and Affordability of Care.” Health Affairs, September 2020.

4. ACHI Arkansas Works updates (2018-2019); Milbank Memorial Fund, “Lessons Learned from Arkansas' Experience with a Medicaid Work Requirement,” June 2025.

5. Center on Budget and Policy Priorities. “Pain But No Gain: Arkansas' Failed Medicaid Work-Reporting Requirements Should Not Be a Model.”

6. Command Direct program results across health plan clients: return mail management outcomes and MyHealth Documents electronic-delivery cost savings; commanddirect.com.

7. Nebraska DHHS and Montana DPHHS implementation materials (2026); Avalere Health state-variability analysis (2026).