Primary source: JAMA, October 26, 2026 · University of Minnesota School of Public Health
Traditional Medicare patients in six states used fewer of the services targeted by CMS's WISeR prior-authorization pilot in the first half of 2026. A JAMA research letter published October 26 finds epidural steroid injections fell 15.0% and other targeted services fell 19.5%, relative to states outside the pilot. The same letter cannot say whether the care that did not happen was wasteful or necessary.
The letter is "Changes in Service Use Following the Introduction of AI-Enabled Prior Authorization in Medicare" (doi 10.1001/jama.2026.21230). Hannah T. Neprash of the University of Minnesota School of Public Health is the lead author. Michael Barnett of the Brown University School of Public Health is the co-author. The University of Minnesota published its release with the letter. JAMA's media release is the other primary account. This article uses those sources, plus a DocWire News report of the quarterly figures and, separately, records the Electronic Frontier Foundation published on October 27.
Relative decline, versus non-pilot states, in the first six months of 2026. Epidural steroid injections were the highest-volume targeted service and fell 15.0%. Other targeted services fell 19.5%. These are not national Medicare volume figures, and they are not a finding that the forgone care was waste.
WISeR, the Wasteful and Inappropriate Service Reduction model, is a six-year Center for Medicare and Medicaid Innovation pilot that launched in January 2026. It runs in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. It adds prior authorization to traditional Medicare for services CMS treats as vulnerable to fraud, waste and abuse. Contracted reviewers, mostly technology firms, are encouraged to use AI.
That is a structural change for fee-for-service Medicare, which has not run prior authorization the way Medicare Advantage does. Neprash put the operating point directly in the University of Minnesota release: "Traditional Medicare has operated almost entirely without prior authorization, so WISeR represents a major change in how older adults access care."
DocWire News reports that the pilot covers 41 services. That count is DocWire's. The research letter's public account, as used here, does not itemize 41 codes. It reports epidural steroid injections as the highest-volume targeted service and groups the rest as other targeted services.
The authors used Epic Cosmos, an electronic health record dataset of more than 300 million patient records. They compared the six pilot states with the other 44 states plus the District of Columbia. The window is two years before the launch against January through June 2026.
The design matters for anyone who wants to read the percentages as a WISeR effect rather than a national trend. The comparison is relative to non-pilot states over the same months. A service that fell everywhere does not show up as a WISeR result. A service that fell only in the six states does.
| Element | What the sources establish |
|---|---|
| Publication | JAMA research letter, October 26, 2026. doi 10.1001/jama.2026.21230 |
| Authors | Hannah T. Neprash, University of Minnesota School of Public Health; Michael Barnett, Brown University School of Public Health |
| Model | WISeR, a six-year CMMI pilot launched January 2026 in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington |
| Data | Epic Cosmos. Pilot states versus the other 44 states plus DC. Two years pre-launch versus January–June 2026 |
| Six-month result | Epidural steroid injections −15.0%. Other targeted services −19.5%. Both relative to non-pilot states |
| What it does not show | Whether forgone care was wasteful or necessary. Orders versus denials. Whether AI was used on a given case |
The six-month averages hide a fade. DocWire reports the epidural steroid injection effect at about 20.7% in January through March and 9.3% in April through June. Other targeted services went from 21.4% to 17.6% over the same quarters. The University of Minnesota release rounds those periods to roughly 21% then 9% for epidural injections, and 21% then 18% for the other services. The two accounts describe the same pattern at different precision. This article treats DocWire's figures as the finer split and the university release as the rounded version, not as a second measurement.
Services that were originally slated for WISeR but never implemented showed no significant change. That control sits next to the targeted-service results. Where the prior-authorization requirement did not actually start, the letter does not find a matching drop.
The study cannot determine whether the care that did not occur was wasteful or necessary. It could not separate fewer orders from denials. It could not observe whether AI was used. The title describes AI-enabled prior authorization because that is the model's design. The data do not show AI making a given decision. A volume decline is not, on this evidence, a proof that waste was removed.
A separate record arrived the next day. On October 27, 2026, the Electronic Frontier Foundation published more than 800 pages of documents obtained under the Freedom of Information Act. EFF is an advocacy group that sued CMS. The account below follows EFF's description of those records. InsureAIWire's summary corroborates it. RevCycleAI has not re-reviewed the full production, and EFF's advocacy role is part of how this evidence should be weighed.
Those records show CMS sent requests for information or corrective action plan requests to at least four of the six WISeR vendors in the first three months of the model.
| Vendor | What EFF reports CMS raised |
|---|---|
| Innovaccer (Ohio) | Corrective action plan requests, and a February 20, 2026 Performance Notice of Non-Compliance, because its provider portal was not live by the January 5 go-live |
| Virtix Health | Turnaround times exceeding guidelines, denials that appeared inaccurate or inconsistent with criteria, and inadequate customer service |
| Zyter | Untimely determination letters |
| Genzeon | Among the vendors that received an RFI or a corrective action plan request. The public summary does not isolate a single defect the way it does for the other three |
The other two vendors are not named in that "at least four" account, and this article does not name them. A missed portal go-live, late letters, and denials CMS itself described as inaccurate or inconsistent with criteria are execution findings. They are not a study result, and they are not a finding that every WISeR denial was wrong.
WISeR is not the January 2026 prior-authorization rule that applies to Medicare Advantage and other managed programs. Separately, CMS-0057-F requires Medicare Advantage, Medicaid, CHIP and Federally-facilitated Exchange payers to decide expedited prior-authorization requests within 72 hours and standard requests within 7 calendar days, as of January 1, 2026. Electronic prior-authorization APIs under that rule are due January 1, 2027. CMS described that schedule in "Moving Prior Authorization into the 21st Century."
The distinction is operational. CMS-0057-F sets decision clocks and an API deadline for specified payers. WISeR puts a prior-authorization step on selected services in traditional Medicare, in six states, through contracted reviewers. A health system that bills both books now has two prior-auth regimes, with different counterparties. The JAMA letter does not measure CMS-0057-F, and the vendor letters above are WISeR documents.
Payer-side prior-auth companies are raising money against the managed-care version of this work. ClarityCare's Series A is one 2026 example, aimed at the plan side of authorization. WISeR is the fee-for-service version: the reviewer sits between a traditional Medicare patient and a targeted service, under a CMS contract rather than a plan policy.
The paragraphs in this section are RevCycleAI analysis. They are labeled that way because the letter does not report revenue, denial rates, or a practice-size breakdown, and because the vendor letters are a separate evidence set from the utilization study.
Traditional Medicare now carries prior-authorization work in six states. Practices that treated fee-for-service Medicare as a book without prior auth have a new workload on the targeted services, limited to Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. The work is not national. It is also not optional inside those states for the services the model actually implemented. Scheduling, clinical documentation and the business office now share a step that traditional Medicare did not used to require.
The utilization drop is a revenue signal for the affected service lines. A 15.0% relative decline in the highest-volume targeted service is volume that did not become a claim, measured against states that did not have the pilot. Epidural steroid injections are a high-volume pain-management service, so pain practices in the six states are the clearest exposure on the published split. The other targeted services fell 19.5% as a group. Spine and other procedural lines are exposed where their codes sit on that list. The letter does not publish a per-code revenue figure, and DocWire's count of 41 services is not a price list. Analysis, not a study result: a sustained relative volume decline is lost professional and facility revenue for the practices that perform those services. It is not a measured dollar loss, and it is not evidence that every forgone service would have been paid.
The fade is consistent with workflow learning, and the letter does not prove the mechanism. The epidural effect moved from about 20.7% in the first quarter of the pilot to 9.3% in the second. Other targeted services eased from 21.4% to 17.6%. Clinics may be learning the request, moving the work onto staff who do it every day, or substituting services. Any of those would shrink the gap without proving the first-quarter decline was waste. The unimplemented-service result, no significant change, makes a general demand shock a weaker explanation for the targeted-service drop. That reading uses the study's own control. It is still an interpretation. The authors do not identify which behavior changed.
Smaller practices without prior-authorization staff are the exposed operators. DocWire's interview with Neprash reports that larger practices are more likely to have dedicated prior authorization staff. Neprash said: "Without that, more of these administrative duties likely fall on clinicians themselves." Analysis: when the clinician is also the authorization staff, some of the volume decline can be requests that were never submitted, not services a reviewer denied. The letter could not separate those two paths. A health system with a centralized prior-auth team and a two-physician pain practice in the same WISeR state are not running the same control environment. The study does not quantify that gap. The staffing observation is the reason to expect it.
The vendor letters are execution risk for AI prior-auth contractors, not a verdict on the model. At least four of six WISeR vendors received an RFI or a corrective action request in the first three months, on EFF's reading of CMS records. Innovaccer's Ohio portal missed the January 5 go-live and drew a February 20, 2026 notice of non-compliance. Virtix Health was cited for turnaround times, denials that appeared inaccurate or inconsistent with criteria, and customer service. Zyter was cited for untimely determination letters. Analysis: an EHR volume drop measured across the same months can mix criteria-based review with operational failure. A portal that is not live and letters that are late will suppress completed care even when the clinical criteria would have allowed it. Investors underwriting technology firms as WISeR reviewers should treat those CMS contacts as evidence about execution. They should not treat EFF's advocacy framing, or this article, as a finding that the model failed or that AI produced the 15.0% figure. The utilization study could not observe AI use.
Continuation and expansion are the decisions to watch. WISeR is a six-year pilot that is six months into its public utilization record. CMS can keep the service list, change it, or extend the state list. Analysis: the second-quarter fade is the number that matters for a run-rate forecast, not the January-to-March peak, and only if the requirement stays in force and the vendors can run it. A model whose reviewers are already in corrective action is a weaker candidate for a quiet expansion than a model with a clean operating record. This article does not predict which choice CMS will make.
The JAMA letter, the JAMA media release and the University of Minnesota release establish the authors, the October 26 publication, the Epic Cosmos comparison, the 15.0% and 19.5% six-month figures, the absence of a significant change for services that were slated and not implemented, and the limits of the study: no judgment on whether forgone care was wasteful or necessary, no separation of orders from denials, and no observation of AI use. Neprash's sentence on traditional Medicare and prior authorization is from the university release. The quarterly figures of about 20.7%, 9.3%, 21.4% and 17.6% are DocWire's; the university release rounds the same periods. The 41-service count is DocWire's.
The October 27 vendor account is EFF's description of FOIA records, corroborated by InsureAIWire. EFF sued CMS. This article does not treat that write-up as an independent audit of the 800-page production. It does not name vendors beyond Innovaccer, Virtix Health, Zyter and Genzeon, and it does not assign Genzeon a specific defect the summaries do not isolate.
No source used here discloses a dollar value for the utilization decline, a denial rate, a practice-size split, a list of the unimplemented services, or proof that AI produced any individual decision. Those gaps are left open. CMS-0057-F's 72-hour and 7-day clocks, and the January 1, 2027 API date, come from CMS's own description of that separate rule.
In six states, traditional Medicare is no longer a prior-auth-free book of business for the services WISeR actually implemented. The first measured result is a relative drop in use, larger at the start and smaller by the second quarter, against a control group of services that were planned and never turned on. That is a revenue signal for the practices that bill the targeted codes. It is not a demonstration that the care was waste, and it is not a demonstration that AI made the call.
The vendor record, read from EFF's release of CMS documents, says the machinery was already in corrective action while that volume was falling. A portal that missed January 5, late determination letters, and denials CMS described as inconsistent with criteria are reasons to treat the early decline as a mix of review and friction. Operators should measure the codes they bill in the states where they bill them. Investors in the contracted reviewers should underwrite execution, not the slogan in the model's name. CMS's decision on whether the pilot continues or grows is still ahead of the evidence published on October 26 and October 27.
Independent analysis of Medicare prior authorization, payer policy and the revenue-cycle consequences of utilization review.
Sources: Neprash and Barnett, JAMA, October 26, 2026 (doi 10.1001/jama.2026.21230); JAMA media release; University of Minnesota School of Public Health; DocWire News (41-service count and quarterly figures); Electronic Frontier Foundation, October 27, 2026, an advocacy group that sued CMS; InsureAIWire; CMS, on CMS-0057-F. The Neprash sentences in quotation marks are the statements authorized from the university release and the DocWire interview. Service-line, staffing and vendor-execution implications are RevCycleAI analysis and are marked as such.