Thoughts on Healthcare Markets & Technology

When consumer health app advertising becomes a reportable data breach: FTC rules, tracking software, consent failures, and the business of controlling sensitive health data outside HIPAA

A consumer health company’s marketing campaign performs exactly as designed. Registrations climb. Attribution looks clean. And it may have just committed a reportable federal data breach. Here is why that is happening across the industry right now…

Listen now

4 minutes ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

The campaign worked. That was the problem.

Coverage follows the product and its data flows

The enforcement cases are a warning about economics

The disclosure hides in the plumbing

Consent has to reach the code

A notification deadline is a data engineering problem

The product worth building has to stop the next disclosure

The investment case starts with customer acquisition math

Abstract

Consumer health companies can create reportable breaches through ordinary advertising workflows, including intentional disclosures that their customers never authorized. The Federal Trade Commission’s Health Breach Notification Rule makes that possibility commercially relevant for certain fertility, medication, fitness, mental health, and other consumer health products outside HIPAA. The resulting opportunity extends across software discovery, consent enforcement, vendor oversight, and incident response. But regulatory exposure alone does not establish a software market. The strongest businesses will connect legal requirements to actual data movement, preserve useful measurement, and demonstrate that their controls survive product changes without requiring an army of consultants.

The campaign worked. That was the problem.

Take a hypothetical fertility app whose growth team has finally figured out paid acquisition. Registrations are improving. The advertising platform is finding people who look like existing subscribers. A new integration sends conversion events back to the platform so its algorithm can distinguish somebody who opened a landing page from somebody who completed an assessment and bought a subscription. The engineering team approved the integration. Procurement approved the vendor. Nobody stole a password, exploited a vulnerability, or demanded payment in cryptocurrency. Unfortunately, the events also reveal sensitive health information linked to identifiable users, and those users never authorized that disclosure. The company may now have a breach notification problem because its marketing software did exactly what it was configured to do.

That possibility is explicit in the FTC’s Health Breach Notification Rule. For covered businesses and information, unauthorized disclosure can constitute a breach even when the disclosure is intentional and no outside attacker is involved. The amendments took effect July 29, 2024, and clarified the rule’s application to health apps and similar technologies. There is also a recent detail worth getting right: in September 2026, the FTC withdrew its 2021 policy statement addressing health apps and connected devices. The commission said that statement had been superseded by rulemaking. Withdrawing the statement did not repeal the amended rule. A compliance strategy built around that headline would be an unfortunate reading comprehension exercise.

For operators, the uncomfortable implication is that cybersecurity and privacy reviews can reach different conclusions about the same transaction. A security review might establish that data traveled through an authenticated, encrypted connection to an approved vendor. A privacy review still has to establish whether that vendor should have received those fields for that purpose. Both reviews can be competently performed, and the transaction can still fail the second one. That creates a plausible business opportunity for software that connects the two. It also explains why another annual questionnaire is unlikely to solve much. The important decisions happen when an engineer changes an event, a marketer activates a destination, or an agency uploads an audience. Those decisions need controls where the work actually happens.

Read more

The FTC’s Health Breach Notification Rule covers fertility, medication, mental health, fitness, and sleep a…

Read more

Trey’s Thoughts on Healthcare Markets & Technology

Part I: Venture opportunities in self-funded health plan prior authorization: Employer controls, portable treatment approvals, and payment accountability after the new federal employer pledge

Amazon, Google, Meta and others signed a prior auth pledge for self-funded plans. The employers did not commit to reducing prior authorization. They said changes would be considered against fiduciary duties. That gap is where the business opportunity lives…

Listen now

a day ago

🎧 Part II Podcast episode also for free subscribers.

Trey’s Thoughts on Healthcare Markets & Technology

Part II: Venture opportunities in self-funded health plan prior authorization: Employer controls, portable treatment approvals, and payment accountability after the new federal employer pledge

Amazon, Google, Meta and others signed a prior auth pledge for self-funded plans. The employers did not commit to reducing prior authorization. They said changes would be considered against fiduciary duties. That gap is where the business opportunity lives…

Listen now

a day ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

What the employer pledge actually changes

The existing market is already busy

Make the employer’s plan executable

Measure the delays that disappear from the dashboard

Build the evidence for retiring authorization

Keep treatment intact when benefits change

Make an approval mean something at payment

The business model has to survive the pilot

Abstract

The expansion of electronic prior authorization into self-funded employer plans creates opportunities for venture-backed companies that help employers control how their benefits actually operate. The strongest candidates connect plan documents to executable administrative rules, measure delays from the original clinical order through treatment, identify authorization requirements worth removing, preserve treatment continuity through benefit changes, and reconcile approvals with payment. Existing vendors already automate substantial parts of this process, so a credible startup needs a narrower claim than faster authorization through artificial intelligence. The investment case rests on obtaining usable data and contractual authority, producing measurable value for a specific buyer, and distributing through administrators or benefits advisers without becoming a custom integration shop. The employer pledge creates a reason to buy these capabilities. It does not supply the operating model.

What the employer pledge actually changes

The interesting part of the October twenty-first announcement is who is asking for change. Amazon, Axon Enterprise, Google, Meta, and Oracle signed a statement supporting the extension of prior authorization reforms to self-funded health plans. The Centers for Medicare and Medicaid Services and the Department of Labor are encouraging that expansion. These employers finance benefits while relying on administrators and other vendors to run much of the machinery. That arrangement creates a straightforward business question: can the organization paying for healthcare verify that its vendors are administering the coverage it actually purchased?

Read the employer statement carefully and the commercial opening becomes clearer. It distinguishes technical improvements that could become available through administrators’ platforms from changes to authorization requirements that employers could consider adopting individually. The statement asks third-party administrators to make technical improvements immediately available to self-funded plan sponsors; employers did not themselves commit to reducing prior authorization and said such changes would be considered against their fiduciary duties. That leaves work to do at the plan level. Somebody has to identify which rules apply, decide which changes make sense, configure them, and verify that they work after deployment. The twenty twenty-four interoperability rule requires electronic prior authorization capabilities from specified Medicare Advantage, Medicaid, Children’s Health Insurance Program, and federal exchange payers, with most application programming interface requirements beginning in twenty twenty-seven. It does not impose those requirements across all self-funded employer plans. Employer purchasing decisions and administrative contracts therefore matter enormously.

Even the market sizing deserves a little housekeeping. The announcement associates millions of people with self-funded coverage, but the Census figure it links to describes employer coverage generally. KFF’s twenty twenty-five employer survey reports that sixty-seven percent of covered workers were enrolled in self-funded plans. Those figures describe different populations and cannot be swapped into the same market model. A startup needs reachable covered lives, participating administrators, and an actual purchasing mechanism. Multiplying everyone with employer coverage by a hypothetical software fee is easy. Getting permission to receive the authorization event feed is where the business starts.

For founders, the useful consequence is a new procurement conversation. An employer can ask its administrator to prove that electronic authorization works for its particular benefits, including delegated services and exceptions. A benefits consultant can make that proof part of an administrator selection process. A startup can provide the measurement and testing machinery. The fax machine is irritating, but it has been taking an impressive amount of blame for contract design.

The existing market is already busy

Authorization automation is an established category. Availity supports standards-based discovery, documentation, and submission workflows. Cohere markets clinical policy management, automated review, selective reductions in provider requirements, and authorization-to-claim matching. Surescripts operates electronic medication authorization workflows, while SamaCare focuses on medical-benefit drug access. A startup claiming to have discovered automated submissions, policy interpretation, or gold carding will have a short meeting with an informed investor. Those capabilities already have vendors, distribution, and customer references.

The opportunities worth examining sit in the specific arrangements those products might support but do not automatically establish. An employer could retain its own independently testable record of agreed authorization rules across administrators. It could purchase measurement of the entire patient journey rather than rely solely on vendor turnaround reports. Multiple employers could evaluate whether removing a particular review requirement actually changes utilization, administrative expense, and access. These are proposed businesses whose novelty needs customer diligence. Public product descriptions cannot establish that nobody is building them, and being less visible than a large incumbent is hardly proof of an empty market.

The customer also needs to be chosen early. A hospital values fewer staff touches and fewer preventable denials. An employer values appropriate access, dependable administration, and reasonable total spending. A manufacturer values treatment initiation and persistence. Those interests overlap, but they produce different product requirements and compensation arrangements. A company paid for increasing drug starts should not quietly present itself as an independent evaluator of employer benefit spending. The party writing the check influences which problems get solved, which metrics look attractive, and which uncomfortable findings survive the quarterly business review.

Make the employer’s plan executable

Consider a hypothetical administrator serving several employers through one recognizable insurance brand. One employer removes authorization for a defined outpatient imaging category. Another keeps it. A third uses a delegated vendor with different documentation requirements. The provider’s electronic system has to reach the correct answer for the individual member, service date, and benefit arrangement. Successfully connecting to the administrator does not establish that the employer’s selected rules are being applied.

A company could sell a plan configuration and verification service that turns agreed benefit terms into a versioned, testable specification. Its input would include the governing plan documents, administrative agreement, adopted medical policies, and documented exceptions. Its output would identify the applicable rule, the entity authorized to decide, the evidence required, and the effective period. Every rule would remain traceable to its approved source. Conflicts would go to the responsible human reviewer. A language model could extract candidate provisions and flag inconsistent language, but it should not resolve a contractual ambiguity by producing a particularly confident sentence.

The existing technical standards provide useful places to connect. Coverage Requirements Discovery addresses what information and authorization may be required. Documentation Templates and Rules supports collecting the needed clinical information. Prior Authorization Support handles submission and responses. A new company’s contribution could be verifying that an employer’s approved configuration survives that entire workflow. For example, a test could check whether an imaging exemption appears during ordering, whether the documentation workflow unnecessarily opens anyway, and whether a downstream system still expects an authorization identifier when the claim arrives.

That testing should cover far more than whether a message conforms to a technical schema. It should examine benefit effective dates, rendering providers, service locations, delegated reviewers, and the treatment of amended requests. Authorized test environments could run synthetic cases before a benefit change takes effect. Production monitoring could compare actual transactions against the approved configuration without inventing patient encounters. Changes would have an owner and a recorded approval. When an administrator updates a shared policy, the product would identify employer configurations affected by the update and rerun the relevant tests.

The buyer could be an employer coalition or benefits adviser that wants the specification to survive an administrator replacement. An independent administrator could also buy it to onboard groups more reliably. The difficult dependencies are access to configuration details, rights to use clinical criteria, and an agreement that someone will fix identified discrepancies. Proprietary medical policies do not become freely reusable because software can read them. Without these arrangements, the product risks becoming an excellent report on mistakes nobody has agreed to correct. With them, annual renewals and benefit changes create recurring work that a reusable software system could handle.

Measure the delays that disappear from the dashboard

The industry’s voluntary pledge includes a target of answering at least eighty percent of electronic authorization approvals in real time by twenty twenty-seven, with the necessary clinical documentation supplied. The denominator deserves attention. An approval metric does not describe every attempted request, and a completed submission clock does not measure everything that happened before the payer accepted the case. This creates room for independent measurement that follows care from the original order through a resolved administrative outcome.

Take an illustrative thousand orders expected to require authorization. Suppose six hundred produce complete submissions, five hundred are eventually approved, and four hundred of those approvals arrive immediately. The real-time approval rate is eighty percent. Immediate approvals account for forty percent of the original orders. Neither calculation has to be wrong. They answer different questions. The remaining orders might involve missing information, routing problems, clinical cancellations, or patients choosing not to proceed. A useful product would investigate those categories instead of treating every missing claim as proof that authorization caused abandonment.

Technically, this requires a persistent case history across systems that create different identifiers for the same episode. The company would connect the clinical order to submission attempts, requests for additional information, revised submissions, decisions, scheduled services, and eventual claims where available. It would preserve unresolved cases in the denominator and distinguish an amended request from a genuinely new treatment decision. The provider’s clock and the administrator’s clock would both remain visible. Missing upstream data would be reported as a coverage limitation, not silently converted into a better turnaround statistic.

The employer could then negotiate service commitments against observable events. An administrator might respond quickly after receiving complete documentation while a delegated vendor takes days to identify what documentation is required. A provider may repeatedly submit an obsolete form. The system should identify both. Commercial value comes from locating a correctable failure, routing it to the party responsible, and verifying the repair. A prettier monthly chart adds little if the next employee encounters exactly the same problem.

Privacy has to be part of the product architecture. HIPAA restricts how identifiable health information may pass to an employer acting as a plan sponsor and requires separation from employment functions. Appropriate plan administration access does not give ordinary managers a view into employees’ treatment. The platform should support controlled access for authorized administrators and carefully designed aggregate reporting for purchasing decisions. Small groups need particular care because apparently anonymous categories can identify a person surprisingly quickly. The appeal of measuring access does not justify turning the benefits department into a clinical surveillance operation.

Build the evidence for retiring authorization

An employer that can observe the workflow can ask a more valuable question: which authorization requirements should disappear? Existing vendors already support selective exemptions and provider programs. The more specific entrepreneurial opportunity is an employer-controlled evaluation service that helps purchasers decide what to remove, negotiates implementation with administrators, and measures the consequences using a consistent method across participating plans.

A high approval rate is a useful screening signal, but it does not establish that the requirement has no effect. Clinicians may have changed their ordering behavior because review exists. Staff may have learned which cases never get through and stopped submitting them. Requests with complete documentation may represent an unusually selected population. Removing the requirement could leave utilization unchanged, increase appropriate access, or increase low-value services. Historical approvals alone cannot distinguish those possibilities.

The product would need clinical governance and credible comparison groups. Participating plans might use a staggered rollout of an approved exemption across comparable provider groups, with adjustment for changes in membership, clinical mix, and benefit design. Where feasible and appropriate, randomized rollout could strengthen the evidence. The evaluation would track service volume and substitution into other services, along with administrative effort and relevant clinical outcomes. It would also identify changes in coding or referral behavior that could make a nominal savings result misleading. Rare harms would require longer follow-up or larger pooled samples than a short pilot can provide.

The economics need equally careful boundaries. Suppose a participating plan spends fifty dollars in avoidable administrative expense per review across ten thousand reviews annually. That is five hundred thousand dollars under those assumptions. If removing the requirement creates four hundred fifty thousand dollars in additional paid claims, only fifty thousand dollars remains before the evaluation vendor’s fee and other effects. Additional care could still be worthwhile. It simply cannot be sold as a large medical savings result. Provider labor savings belong in a separate account unless the buyer can capture them through a commercial arrangement.

A venture-backed company could charge for policy evaluation and ongoing monitoring, with expansion through employer coalitions and administrator partnerships. Payment per submission would create an awkward incentive for a product meant to reduce submissions. Subscription revenue is easier to reconcile with successful removal. Defensibility would come from well-characterized policy changes, trustworthy comparisons, and permission to reuse suitable aggregate findings. The important dataset would record what happened after a rule changed, including cases where removal disappointed. A database containing only favorable case studies is a marketing department with storage costs.

Keep treatment intact when benefits change

Specialty care creates another potential business because a treatment episode can outlast the administrative arrangement that originally approved it. An employer replaces its administrator or pharmacy benefit manager. An employee changes plans. A therapy’s delivery route or site changes. Clinical history remains relevant, but the operational workflow may start over. That is an expensive place to keep rediscovering facts already established.

The regulatory work is moving toward broader drug coverage, but founders need to distinguish proposals from obligations. The twenty twenty-four rule excluded drugs from its authorization requirements. The April twenty twenty-six proposal would extend requirements to drugs, with medical-benefit workflows using the relevant interoperability interfaces and pharmacy-benefit workflows using prescription drug standards for specified payers. As of October twenty-second, that proposal remains a proposal and should not be treated as a finalized universal deadline. A company serving employers still needs workable connections and contractual participation from the medical administrator, pharmacy benefit manager, and other relevant parties.

A focused startup could build a portable treatment record for use during an administrator transition. For an ongoing biologic treatment, that record might include the diagnosis, previously tried therapies, documented reasons for discontinuation, relevant clinical evidence, and the existing authorization’s conditions. Each fact would carry its source and date. Historical treatment failures would be distinguishable from information requiring refresh. The system would identify what the receiving administrator accepts, which requirements remain unmet, and whether the next scheduled treatment falls inside an unresolved coverage period.

There is already a continuity commitment in the industry pledge, but its boundaries matter. It describes a minimum ninety-day transition for the same service under the same benefit type, in network, after treatment has begun. That language does not promise universal portability across a medical-to-pharmacy benefit change, a different network, or every self-funded arrangement. The receiving party has to recognize the applicable obligation or explicitly accept the transition arrangement. Moving an authorization document is technically useful. Getting a receiving administrator to acknowledge what it will honor is the commercial work.

The hardest cases involve benefit coordination rather than missing paperwork. A specialty therapy might require alignment between the drug authorization, administration services, the treatment site, and the supplying pharmacy. Drug identifiers and medical billing units need clinically correct interpretation; a simple code crosswalk cannot establish equivalence across all products and dosing arrangements. An approval for the product may leave the infusion service unresolved. The proposed software should maintain those separate dependencies and detect conflicts before the appointment, without choosing a treatment or changing the clinician’s order.

A sensible starting customer could be a benefits adviser managing large administrator transitions, supported by a defined specialty provider network. That creates a bounded implementation event and a measurable outcome: fewer treatment interruptions attributable to administrative transition, with acknowledged responsibility for resolving exceptions. A manufacturer might also value the service, but manufacturer sponsorship would need transparent limits if the company simultaneously claims independence for employer purchasing decisions. The company would have to show why its transition workflow complements existing specialty access platforms and earns incremental payment. General enthusiasm about continuity is not a purchase order.

Make an approval mean something at payment

An authorization can be approved while the eventual claim still fails. Payer materials explicitly warn that authorization does not guarantee benefits or payment. Eligibility, the actual service delivered, contractual terms, and other conditions still matter. That limitation gives founders a tempting opening, but basic authorization-to-claim matching already exists. A differentiated business would need to take the next step into agreed responsibility for preventable administrative discrepancies.

Imagine a provider obtains an approval covering a particular service and site, performs the service within the approved period, and submits a conforming claim. The claim then encounters an authorization-related denial because the adjudication system did not receive the approval or associated it with the wrong identifier. A product could preserve the original authorization response, connect it to the relevant claim lines, identify the discrepancy, and present the administrator with the evidence needed to resolve it. It would distinguish that situation from a claim that exceeds the approved units or describes a different service.

Useful reconciliation requires more than a denial label. It needs the submitted claim, adjudication results, adjustments, and the authorization history, together with the applicable contractual rules. A remittance reason can indicate where to investigate without establishing the full cause. The software also has to track corrected claims and reversals so it does not declare victory on a payment subsequently recouped. Shared identifiers help, but systems will still need careful matching when a treatment episode produces multiple claims or a claim contains several authorized services.

The ambitious commercial extension would be a narrow contractual assurance. An administrator could agree to a defined remedy when its own processing contradicts a qualifying approval, subject to explicit conditions and exclusions. The startup would supply the verification machinery and manage the dispute workflow. That is meaningfully different from promising that every approved service will be paid. If the startup begins absorbing uncertain losses itself, it needs separate analysis of capital requirements and whether the arrangement constitutes regulated risk transfer. An insurer partner might become relevant later. A seed-stage company should not discover its underwriting business through a surprisingly expensive customer support ticket.

The employer’s incentive here also needs explanation. Paying valid claims reliably does not automatically reduce near-term medical spending. The value may be fewer disputes, lower administrative expense, better provider relationships, and less employee exposure to avoidable billing problems. Providers may therefore be the more natural initial buyer, while administrators participate because they can reduce reconciliation costs. The product’s commercial structure should reflect who actually receives the benefit.

The business model has to survive the pilot

The strongest initial thesis is probably the combination of employer plan verification and independent workflow measurement. They address a purchaser’s need to know whether selected reforms were implemented and whether access improved. Authorization retirement could become an expansion product once the company has adequate event history and evaluation expertise. Specialty continuity offers a different starting point for a team with pharmacy and infusion distribution. Payment assurances belong later, after the company understands the error patterns and has negotiated responsibility for them. These opportunities do not need to be stuffed into one seed-stage roadmap.

The revenue arithmetic should be explicit. At an assumed one dollar per covered member per month, two hundred thousand covered lives produce two million four hundred thousand dollars in annual revenue. Five million lives produce sixty million dollars. Those are illustrations, not established market prices or proof of willingness to pay. They show why distribution matters. A company pursuing large outcomes needs repeatable access through administrators, coalitions, or advisers, and it must account for channel fees and customer concentration. Hundreds of bespoke employer implementations would make that arithmetic much less appealing.

Gross margin should include the people who resolve mapping problems, review policy conflicts, maintain connections, and support customers. Calling those people implementation resources does not make their cost temporary. The company needs evidence that each additional employer requires less incremental work because the underlying administrators and rule structures are already supported. A useful technical advantage would be reusable tests and reliable data normalization. A useful commercial advantage would be a contract that keeps the service in place when the employer changes its administrator.

Early diligence should establish that the buyer can obtain the required data and secure cooperation from the parties expected to act on findings. A pilot needs a defined scope, agreed baseline, and a payable success condition. For configuration testing, that might mean detecting and correcting discrepancies before a benefit change goes live. For continuity, it might mean receiving documented acceptance of active treatment arrangements before the transition date. For workflow measurement, it might mean reducing a specific source of delay while reporting unresolved cases honestly. Counting connected interfaces would prove very little about any of these outcomes.

Investors should be prepared to walk away when the administrator will not provide usable events, the employer lacks practical authority to change the process, or the proposed savings depend entirely on unverified assumptions. A buyer who enjoys the findings but has no budget or contractual remedy is another warning. The first valuable commercial proof would be an employer paying for an independently verified correction, an administrator accepting responsibility for maintaining it, and the same software reproducing that result for another group. That would be a much stronger foundation than a faster authorization demo.

The existing vendor market is already busy. Availity, Cohere, Surescripts, SamaCare all automate substantial parts of this process. A startup claiming to have discovered automated submissions will have a short investor meeting.

The real opening: an employer can now ask its administrator to prove the benefit rules it purchased are the rules actually running. Successfully connecting to an admin system does not prove the employer’s selected rules are being applied.

The article maps five specific venture archetypes - plan verification, workflow measurement, authorization retirement, specialty continuity, and payment reconciliation - and works through the revenue arithmetic and investment conditions for each.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

The existing vendor market is already busy. Availity, Cohere, Surescripts, SamaCare all automate substantial parts of this process. A startup claiming to have discovered automated submissions will have a short investor meeting.

The real opening: an employer can now ask its administrator to prove the benefit rules it purchased are the rules actually running. Successfully connecting to an admin system does not prove the employer’s selected rules are being applied.

The article maps five specific venture archetypes - plan verification, workflow measurement, authorization retirement, specialty continuity, and payment reconciliation - and works through the revenue arithmetic and investment conditions for each.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Trey’s Thoughts on Healthcare Markets & Technology

Part I: Private Equity and Venture Capital Opportunities in Rural Health Transformation: What State Funding Commitments Reveal About Software, Services, Acquisitions, and Sustainable Revenue

CMS published the first Rural Health Transformation obligation report. Ten billion in state awards. Only about four billion reported as obligated through July 2026. Florida: under 1% obligated. Georgia: 100…

Listen now

a day ago

🎧 Part II Podcast episode.

Trey’s Thoughts on Healthcare Markets & Technology

Part II: Private Equity and Venture Capital Opportunities in Rural Health Transformation: What State Funding Commitments Reveal About Software, Services, Acquisitions, and Sustainable Revenue

CMS published the first Rural Health Transformation obligation report. Ten billion in state awards. Only about four billion reported as obligated through July 2026. Florida: under 1% obligated. Georgia: 100…

Listen now

a day ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

The report is a buyer map, with some potholes

Private equity can build the operating infrastructure

Venture capital should solve the missing workflow

The catalyst funding is useful, and conditional

Care delivery needs someone to pay after the pilot

Pharmacy and medtech have their own opportunities

Distribution runs through state procurement

Buying hospitals is a different investment

Underwrite the customer who stays

Abstract

The Rural Health Transformation Program creates a substantial opportunity for investors in healthcare software, services, and delivery infrastructure. Its first obligated funds report shows roughly four billion dollars committed against nearly ten billion dollars in initial state awards, with enormous variation across states. Those commitments reveal specific demand for revenue cycle support, credentialing, cybersecurity, data exchange, remote care, workforce development, and medical equipment. Private equity has a plausible route through established service businesses with rural distribution. Venture capital has a narrower opportunity in repeatable products that solve expensive operational problems, plus conditional funding for early technology development. The central investment challenge is converting temporary public funding into revenue supported by a lasting customer budget. Buying a company because its customers received grants is easy. Establishing what those customers will keep buying takes considerably more work.

The report is a buyer map, with some potholes

A fifty billion dollar healthcare program is going to produce a heroic number of rural strategy decks. The Rural Health Transformation Program will make ten billion dollars available annually across five fiscal years, beginning in fiscal year twenty twenty-six and ending in fiscal year twenty thirty. That is enough money to change purchasing behavior. It isn’t a fifty billion dollar software market, though. Much of the funding supports workforce programs, clinical initiatives, public agencies, and infrastructure. The investable opportunity sits inside particular purchases, contracts, and operating changes. A company needs a product someone is authorized to buy, a route through the purchasing process, and economics that survive after the initial subsidy. The last part tends to get noticeably less space in the deck.

The obligated funds report covers late December twenty twenty-five through the end of July twenty twenty-six. Adding its fifty state award totals produces approximately ten billion dollars. Adding the separately reported state obligation totals produces approximately four billion dollars, or forty percent of those awards. Roughly six billion dollars therefore had not been reported as obligated at that cutoff. Those figures are state-reported obligations, not cash disbursed. The calculation uses the state totals, not the sum of every initiative heading and its underlying line items. It also doesn’t mean six billion dollars remains available today. The information is a July snapshot published in October, and the report explicitly says it is not a complete account of state progress. CMS says the report will be refreshed after the November 30, 2026 quarterly submissions.

The geographic spread is striking. Georgia, Hawaii, and New Hampshire reported obligations equal to their entire initial awards. California reported approximately two hundred nineteen million dollars, nearly ninety-four percent of its award. Florida reported about one million eight hundred thousand dollars against approximately two hundred ten million, less than one percent. New York and West Virginia reported zero. Fifteen states were below ten percent, while eight exceeded ninety percent. Those differences could reflect contracting structures, timing, implementation capacity, or reporting practices. They don’t establish that one state has transformed care and another has accomplished nothing. A state can commit money to an intermediary before that intermediary has selected the companies that will do the work.

There are also actual potholes in the document. Some category subtotals do not reconcile with their listed components, including examples in the Hawaii and Missouri sections. That makes a mechanically generated national technology spending total suspect without reconciliation. The useful approach is to treat individual entries as leads, then obtain the approved scope, recipient information, and relevant procurement documents. An obligation isn’t a vendor payment, and neither one proves recurring revenue. For an investor, the report is unusually useful evidence of purchasing intent. It still needs to be connected to an actual customer.

Private equity can build the operating infrastructure

The most straightforward private equity thesis involves businesses that already help small providers operate. Kansas lists approximately three million six hundred thousand dollars for revenue cycle support and a centralized credentialing organization, plus one million five hundred thousand dollars for a statewide commercial rate analysis. Maryland lists nine hundred thousand dollars for coding, billing, and revenue cycle technical assistance. These are specific buying signals for services with an existing operating rationale. A rural practice doesn’t need another explanation of why cash flow matters. Its billing office may already be held together by two people and an agreement that neither takes vacation at the same time.

A sponsor could acquire a regional revenue cycle or provider administration business with established relationships, then expand the services those customers actually need. Credentialing leads naturally into payer enrollment, roster maintenance, and identifying clinicians who are treating patients before their billing status is ready. Denial management can expose failures in eligibility checks, documentation, or authorization workflows. The financial benefit needs to be measured in incremental collectible revenue and lower operating cost. Faster collections can release working capital without increasing lifetime revenue, while collecting previously abandoned claims can improve both. Treating those outcomes as interchangeable makes the return calculation look better than it is.

Technology implementation offers another route. Mississippi reports forty-seven million five hundred thousand dollars for its rural provider technology grant program. Iowa identifies approximately eleven million seven hundred thousand dollars for implementing its new health information exchange. A regional managed technology provider could supply installation, integration, cybersecurity, and continuing support across multiple facilities. The acquisition target’s value would depend on reusable implementation methods, technician capacity, and customer retention. A collection of unrelated consulting projects won’t become a high-margin software company simply because the sponsor standardizes the invoice template.

The attractive operating model spreads expensive expertise across customers too small to maintain it individually. Security monitoring, identity administration, interface maintenance, and revenue operations all lend themselves to that approach. There is still plenty of execution risk. Rural travel can consume technician capacity, legacy systems can turn fixed-price projects into losses, and understaffed clients can struggle to adopt new workflows. Diligence should examine delivery costs by customer cohort and location, not just consolidated margins. The grant can help a provider afford migration. The ongoing contract has to earn its place in the operating budget.

Venture capital should solve the missing workflow

Venture investors need a different filter. An attractive service business doesn’t automatically support venture returns. The product has to travel across customers without rebuilding the company every time it crosses a state line. Missouri lists approximately four million two hundred thousand dollars for ambient artificial intelligence licenses, deployment, implementation support, and change management. Virginia identifies approximately nine million nine hundred thousand dollars for decision support, documentation, and workflow tools. Those entries establish demand, but also reveal how much sits around the software. Customers need deployment and workflow change alongside access to a model. A startup that overlooks those costs can have impressive contracted revenue and thoroughly unimpressive contribution margins.

The stronger opportunities are narrow enough to measure. A documentation product might reduce the time between a visit and a completed, billable note. A referral product might get a patient into a specialist appointment and return the result to the referring clinician. A credentialing product might identify and resolve missing enrollment information before it causes denied claims. Each has a different buyer and economic justification. Minutes saved don’t automatically become additional appointments, and additional appointments don’t automatically become collected revenue. An underwriting model should follow the chain through to the financial result, including physician review time, correction rates, and the work shifted onto other staff.

Interoperability is another plausible entry point, provided the company tackles the operational mess. Wisconsin lists approximately two million five hundred thousand dollars across closed-loop referral systems for its community and health information exchanges. The difficult work includes patient matching, reconciling local codes, tracking consent, and returning usable information to the right clinical workflow. A referral marked transmitted is not the same thing as a referral completed. An investor should want evidence that the product handles rejected referrals, unavailable appointments, missing records, and patients who never answer the phone. That’s where a supposedly simple workflow acquires enough complexity to support a useful business. Federal guidance places a five percent limit on replacing qualifying existing electronic record systems while exempting upgrades, interfaces, and added functionality from that specific cap. Modular vendors have a concrete opportunity, provided their products actually qualify as enhancements.

The same discipline applies to data products. Clinical records, submitted claims, and remittance information answer different questions. A platform estimating the financial impact of an intervention needs to understand what was delivered, what the payer adjudicated, and what cash ultimately arrived. State funding does not itself grant a vendor unrestricted rights to commercialize patient information. Contractual data rights, permitted uses, provenance, and access after termination belong in product diligence. A defensible company can emerge from reliable integration and workflow performance. A warehouse full of incompletely understood records is mostly an expensive way to postpone the hard questions.

The catalyst funding is useful, and conditional

The Rural Tech Catalyst Fund mechanism deserves separate attention because it can support early development without requiring founders to give up equity. Its limits are specific: a state’s allocation to this type of initiative cannot exceed the lesser of twenty million dollars or ten percent of its award for the budget period, with a separate three million dollar limit on funding to any one company. This is not authority for the state to capitalize a conventional venture fund that generates investment returns. For a venture investor, the opportunity is to finance a qualifying operating company alongside restricted development funding, with each funding source doing a clearly defined job.

Current guidance targets novel, consumer-facing technology for rural chronic disease prevention and management, generally from demonstrated proof of concept through a minimum viable product. It describes applicants founded less than ten years ago with less than fifty million dollars previously raised. Fully commercialized products focused on marketing and sales fall outside that stated development profile. That creates a practical distinction between developing a genuinely new capability and trying to get government funding for an ordinary sales campaign. Virginia’s approximately nine million nine hundred thousand dollar consumer technology innovation entry is worth investigating, but the report alone doesn’t establish a particular company’s eligibility or whether an application window remains open.

The funding can pay for evidence that private investors would otherwise have to finance themselves. A company might test whether a device works reliably under rural connectivity constraints or whether a care intervention produces a meaningful clinical result. The milestone structure still creates working capital needs: the guide allows no more than twenty percent at kickoff, and later payments depend on performance. The guide states that payments are milestone-based and tied to defined technical and outcome milestones, and that budget-period funds must be paid to selected applicants by the end of the subsequent federal fiscal year. For copyrighted work developed with the funding, the government retains royalty-free, nonexclusive rights for federal purposes, including after an acquisition. Patent obligations apply separately. Developers may retain ownership and commercialize their products, subject to applicable requirements. Investors should separate preexisting technology from funded development and understand the resulting rights before assigning value to exclusivity. The useful outcome is better technical evidence and a credible route to paying customers. A successful grant application by itself doesn’t establish either.

Care delivery needs someone to pay after the pilot

The clinical opportunity is substantial, particularly where a regional service can share scarce expertise across several communities. California lists approximately thirty-nine million dollars for hub-and-spoke partnerships and roughly twelve million four hundred thousand dollars for implementation and technical assistance. Utah identifies approximately twenty-four million eight hundred thousand dollars for scalable rural telehealth infrastructure, technology, and services. These commitments could support businesses that make specialty capacity available across dispersed sites. The harder commercial work is deciding how much clinician availability to reserve, how patients enter the service, and who pays when volumes don’t fill the schedule.

Telehealth becomes an operating business once someone has to answer the consult, review the chart, arrange local follow-up, and manage escalation. A psychiatric consultation can improve access while leaving the local practice with additional monitoring responsibilities. A remote specialist can recommend testing that patients cannot obtain nearby. Those handoffs belong in the delivery model and its cost structure. A service with excellent specialist utilization can still fail commercially if each participating clinic needs extensive unreimbursed coordination. Network density matters here, but density means enough appropriate demand within a workable service footprint, not merely a long list of participating locations.

Remote monitoring has the same issue. Virginia lists approximately fourteen million eight hundred thousand dollars covering devices, applications, clinical dashboards, integration, training, and patient engagement support. Device distribution is the beginning of the expense. Someone must enroll patients, troubleshoot equipment, distinguish actionable changes from noise, and act on findings. The sustainable contract could come from a provider, insurer, employer, or organization taking financial responsibility for a population. Those buyers do not share identical incentives. Under volume-based payment, avoiding an admission can reduce hospital revenue while leaving staffing costs largely intact. The agreement needs to allocate the benefit in a way that keeps the necessary providers participating.

The program’s fifteen percent limit on Category B provider payments is relevant, but it isn’t a blanket limit on every dollar reaching a provider. Technology and model implementation can fall under other categories. The prohibition against duplicating existing payment also matters when designing the service. Grant funding should not be casually stacked onto an already reimbursed encounter. For investors, the more durable model has a defined payment pathway and credible outcome measurement. Claims savings should be assessed with adequate follow-up, appropriate comparison groups, and attention to changes in enrollment and patient mix. A decline after enrolling unusually expensive patients can partly reflect regression toward their usual spending. That is a statistical problem, not evidence that the care team has discovered magic.

Pharmacy and medtech have their own opportunities

Pharmacy is an appealing local access point because the operating infrastructure already exists. Missouri lists approximately two million dollars for expanding pharmacy-based services, including testing and treatment, chronic disease management, behavioral health screening, and coordination. Ohio identifies one million one hundred fifty thousand dollars for pharmacy access to electronic medical records. These entries suggest an opportunity to connect pharmacies to clinical workflows that extend beyond dispensing. A useful company could help exchange relevant clinical information, document a service, route follow-up, and submit a claim through the appropriate payment channel.

The pharmacy benefit and medical benefit create very different commercial problems. A paid prescription claim does not establish that a pharmacist’s clinical service will be reimbursed. Scope of practice, payer recognition, enrollment, contracting, and documentation all need to work for the service being offered. Better connectivity also doesn’t repair an unfavorable dispensing contract. A pharmacy acquisition thesis should therefore separate dispensing economics from incremental clinical service economics, including the pharmacist time required. The strongest technology opportunity may sit in the administrative machinery that makes those services deliverable and payable across a network, rather than in owning every participating pharmacy.

Medical equipment produces a different set of opportunities. Texas reports twenty million dollars for advanced medical buses, with local emergency services and fire departments responsible for hosting, staffing, and maintaining them. Pennsylvania’s entries include imaging systems, monitoring equipment, and upgrades to existing facilities. Private equity could find attractive businesses in equipment servicing, deployment, maintenance, and clinical engineering, particularly where a regional footprint improves technician utilization. A grant-financed installation can create continuing service demand, but that demand depends on a working asset with an operating budget. Investors should examine maintenance attachment, parts availability, and who actually funds service after the warranty ends.

For device companies, the grant may overcome the initial purchase barrier while leaving utilization and staffing constraints untouched. A scanner without reliable technician coverage does not become productive because its acquisition cost was subsidized. Capital rules also distinguish existing infrastructure improvements from other equipment uses, and new construction is prohibited. The permitted category depends on the actual project. For pharma and biotech investors, these delivery improvements may eventually support diagnosis, treatment access, or research participation, but drug development and sponsor-funded research need their own commercial rationale. Rural infrastructure funding is not evidence of a new pharmaceutical revenue stream.

Distribution runs through state procurement

The company that understands the buyer can outperform the company with the better demo. The relevant buyer may be a state agency, a hospital association, a university, a regional network, or a provider receiving a subaward. California lists seven million four hundred eighty thousand dollars for third-party grant administration. Alabama identifies approximately five million one hundred fifty thousand dollars for a grant management agreement. These entries show that intermediaries are part of the purchasing structure. They may coordinate implementation or manage downstream funding, but their presence doesn’t establish that they control every vendor decision.

A commercial team should work backward from a specific initiative to the organization with purchasing authority. It needs the approved scope, eligible customer population, procurement route, implementation schedule, and payment conditions. The July obligation percentages can help prioritize investigation, but neither a low nor a high percentage settles whether a sale is possible. A fully obligated state may still have downstream purchasing ahead. A state with few reported obligations may have already advanced substantially since the cutoff. That makes current solicitation and recipient information more valuable than a colorful map ranking states by supposedly available money.

The distinction between a contractor and a subrecipient deserves attention before margins enter the model. A subrecipient carries out part of the funded program; a contractor supplies goods or services through a procurement relationship. Classification follows the substance of the arrangement, not whichever label produces more attractive economics. Federal rules generally prohibit recipients and subrecipients from retaining profit from financial assistance unless expressly authorized. A commercial vendor contract has a different framework. Private ownership alone is not a blanket exclusion from downstream participation, but actual state eligibility and contract terms still govern. A business needs advice on the arrangement it is entering, not a generic conclusion that all federal money works the same way.

For a startup, partnering with an established implementer can reduce the burden of reaching small providers individually. The trade-off is lower margin and less control over the customer relationship. Contract terms should address who renews the software, who supports it, and whether the company can retain the customer if the intermediary’s engagement ends. A large initial order is much less valuable when the startup has no direct route to renewal.

Buying hospitals is a different investment

Buying a struggling rural hospital because a transformation program exists is a much more demanding thesis than acquiring a company that services rural providers. Grants can help fund a defined operational change. They don’t automatically repair unfavorable reimbursement, an unsustainable service mix, a shrinking catchment area, or persistent staffing costs. A hospital can become more technologically capable while remaining economically fragile. The sponsor needs to establish which specific problem is fixable, what the intervention costs, and how the resulting benefit reaches operating cash flow.

Underwrite the customer who stays

The central diligence question is not whether a rural customer can access transformation funding. It is whether the customer will still pay when that funding is no longer the source of the invoice. The CMS report is a useful July snapshot of state-reported obligations, not a forecast of vendor revenue or cash disbursement. The program is now moving through state implementation, procurement, and reporting rather than remaining merely an announced pool of capital.

Investors should trace each opportunity from state award to approved project, from approved project to procurement or subaward, and from that arrangement to the budget that supports renewal. They should distinguish implementation revenue from recurring revenue, grant-funded staffing from permanent staffing, and measurable operating improvement from activity that merely looks busy. Rural transformation can create valuable businesses. The strongest ones will be those that use public funding to establish a service a customer continues to need—and continues to buy.

A plausible acquisition might involve an institution with a viable local role that has accumulated avoidable administrative costs or lost services that could be restored sustainably. The underwriting would still have to examine payer mix, collected rates, workforce availability, referral patterns, and capital needs. Payment methodology matters as much as ownership. A service reduction that appears attractive under one reimbursement structure may have different consequences under another. Adding several fragile facilities to a portfolio doesn’t remove those issues. It can make the financing structure dependent on several simultaneous turnarounds, each with its own local politics and clinical constraints.

Any anticipated grant should be evaluated separately from the acquisition price and ordinary operating funding. The buyer needs to understand whether an award survives a change of control, whether assignment requires consent, what obligations attach to funded equipment, and who bears repayment exposure if conditions are breached. Management service arrangements and affiliated vendors also require scrutiny when public funds are involved. The report itself cannot resolve those questions. Counting an expected award as unrestricted cash available to support acquisition debt is an assumption that needs to be dismantled before signing.

There may be a more practical route through shared services that leaves provider ownership intact. A regional platform can support independent facilities with billing, technology, purchasing, and selected clinical services. That model still needs credible pricing and performance, but it can spread fixed costs without requiring a sponsor to acquire every building and assume every liability. Local governance also has commercial value when the business depends on physician participation and community trust.

Underwrite the customer who stays

The valuation problem is easier to see with an illustrative acquisition. Suppose a business reports ten million dollars in revenue and two million dollars in earnings before interest, taxes, depreciation, and amortization. Four million dollars of that revenue comes from temporary implementation work contributing one million two hundred thousand dollars of those earnings. Without replacement work or further cost reductions, continuing earnings would be eight hundred thousand dollars. Paying ten times the reported two million produces a twenty million dollar purchase price, equivalent to twenty-five times the continuing earnings. The business hasn’t become expensive because the calculation is pessimistic. It has become expensive because different kinds of earnings were priced as if they would last equally long.

Software requires its own version of that analysis. A monthly invoice does not make the underlying demand durable when a temporary grant pays it. Investors should track whether customers renew using their own operating budgets, whether the price changes, and what support costs accompany retention. They should also look through apparent customer diversification. Several dozen provider customers funded by the same state initiative share a material funding exposure. Future state awards and budgets can change, so extending an initial contract value across the entire program is not a substitute for contracted backlog.

Working capital can become the immediate constraint even when the longer-term business is sound. Hiring implementation staff, purchasing equipment, and deploying before payment can consume cash quickly. The financing plan needs to follow actual milestones, acceptance conditions, and payment obligations. Equity or an appropriate credit facility should fund the realistic deployment cycle, including delays. A company can win more contracts than it has the capacity to deliver, and the resulting service problems can damage precisely the relationships that were supposed to produce renewal revenue.

For private equity, the strongest candidates are established operators that can expand an existing customer base while maintaining delivery quality and collecting cash. For venture capital, they are products whose deployment becomes more repeatable, whose economic benefit is measurable, and whose buyers have a reason to keep paying. The program can help fund implementation, clinical validation, and access to customers that were previously difficult to serve. The decisive evidence arrives later, when the subsidy is no longer doing the selling and a customer chooses to renew anyway.

The geographic spread is real but misleading. A fully obligated state may still have downstream vendor purchasing ahead. A state at zero may have advanced substantially since the July cutoff.

The report names specific categories: revenue cycle, credentialing, ambient AI deployment, health information exchange, remote monitoring, documentation tools. Those are actual purchasing signals, not vague priorities.

The real investment question is not whether rural customers can access the funding. It is whether they will still pay when the grant is no longer the source of the invoice. That is where most decks go quiet.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

The geographic spread is real but misleading. A fully obligated state may still have downstream vendor purchasing ahead. A state at zero may have advanced substantially since the July cutoff.

The report names specific categories: revenue cycle, credentialing, ambient AI deployment, health information exchange, remote monitoring, documentation tools. Those are actual purchasing signals, not vague priorities.

The real investment question is not whether rural customers can access the funding. It is whether they will still pay when the grant is no longer the source of the invoice. That is where most decks go quiet.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Trey’s Thoughts on Healthcare Markets & Technology

Part 1: Building the Medicaid work requirement exemption and reinstatement business as Fortuna's clinical layer instead of its competitor, from Nebraska to 2028

CMS’s September guidance split the medically frail Medicaid exemption into three tiers. Only tier three requires a licensed clinician. That tier is still unserved…

Listen now

3 days ago

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Trey’s Thoughts on Healthcare Markets & Technology

Part 2: Building the Medicaid work requirement exemption and reinstatement business as Fortuna's clinical layer instead of its competitor, from Nebraska to 2028

CMS’s September guidance split the medically frail Medicaid exemption into three tiers. Only tier three requires a licensed clinician. That tier is still unserved…

Listen now

3 days ago · 1 like

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

1. What changed since August

2. The market need, restated

3. Why competing with Fortuna is the wrong business

4. What Fortuna has and what it is missing

5. The partnership, piece by piece

6. The rules engine as the shared asset

7. Who pays and how the money moves

8. Beachheads and the first hundred days

9. Where the partnership breaks

10. What has to be true by January

Abstract

The August essay argued that the Medicaid work requirement created a clinical chore nobody was staffed for. Two things happened since. CMS’s September 8 medical frailty guidance made the chore smaller and more specific, splitting it into three optional tiers where only the third one necessarily requires individualized manual review. And the lawsuit did not go away: the preliminary injunction was denied in July, and the court was set to hear summary-judgment arguments on October 20.

Fortuna Health owns the consumer navigation layer, with a16z money, 21 states, plan contracts covering 25 million-plus Medicaid lives, and a hospital channel through Cedar. Building a second navigator is a price war with free. Fortuna’s own writing on the guidance says it wants to help members know what documentation to submit and help plans fold state exclusion methodologies into care management. That is a description of a supplier it does not have.

The business to build is the clinical layer behind Fortuna and the hospital eligibility vendors: a state-by-state frailty rules engine, licensed clinicians producing Tier 3 documentation, and a reinstatement shop that works fair hearings. Fortuna’s navigators triage, the clinical layer certifies, Fortuna files. Direct sales go only to FQHCs and CCBHCs, where no navigator exists.

Who pays: providers on contingency, plans through Fortuna on per-packet pricing structured for the IFC’s conflict rules, states through their incumbents for Tier 3 review surge.

Beachheads: North Carolina and Utah first, because both barred first-year self-attestation and both sit in Fortuna’s footprint. Nebraska and Montana direct through health centers, because terminations there are already real. The 2028 reverification cycle is where the volume is.

Break points: a court vacating the impairment test, states building frictionless provider portals, Fortuna deciding to build it in-house, and the False Claims Act line that a sloppy operator will cross by March.

What changed since August

The August essay leaned on a June interim final rule and a hunch that the functional impairment test would turn a code lookup into a clinical workflow. The rule is still the rule. CMS-2454-IFC took effect July 31, comments closed the same day, and nothing has replaced it, which is how interim final rules work when an agency is not obligated to revise before go live. What did arrive was a slide deck. On September 8 CMS posted implementation guidance for the medically frail exclusion, and the deck matters more than most rules do because it tells states how to actually run the thing. The guidance is optional, and it sorts frailty into three tiers. Tier 1 is conditions where an ICD-10 code may independently establish both the condition and significant impairment; Tier 2 is a diagnosis plus supplemental information such as utilization, pharmacy, durable medical equipment, or other clinical data; Tier 3 is everyone the available data cannot sort, which triggers individualized review and may require additional documentation. CMS said the point of a data-first design is to limit reliance on manual verification by a clinician or caseworker. So the August thesis was half right. The code lookup came back for the sickest slice. The clinical workflow survived for the residue, although the size of that residue will depend on each state’s methodology.

The deck also settled the plumbing. States must maintain an auditable condition list and revise it as they learn. Frailty gets reverified at least every twelve months. Self-declaration under penalty of perjury is a state option when no reliable data exist, subject to the statutory transition rules. CMS also expects states to use available claims and other data to identify qualifying conditions. Meanwhile the litigation did exactly what litigation does. Twenty-five states and DC sued in Massachusetts v. Oz over the impairment test, the twelve-month lookback and the hardship exception. Judge Stearns denied the preliminary injunction on July 29, without prejudice, on the ground that the states had not shown irreparable harm. On October 20, the court declined to block the federal requirement, leaving the medically frail impairment standard in place as implementation proceeds. NHeLP and sixty-nine other organizations filed an amicus in September carrying Manatt’s estimate that the frailty restrictions alone cost about 1.8 million people coverage per year through 2034. And the early states turned out to be earlier than the August essay said. Nebraska went live May 1. Montana launched July 1 with disenrollments possible from October. Arkansas soft-launched July 1 with no disenrollments until January. Iowa starts December 1. North Carolina and Utah passed laws barring self-attestation in the first year. Writing that no state had put a 2026 date into effect was wrong in August and is more wrong now, which is the kind of thing worth saying in print before someone else does.

The market need, restated

Start with CMS’s own math, because it is the only math the counterparty cannot argue with. Roughly 18.5 million expansion adults are subject. CMS projects 26 percent land in an exclusion or exception, and projects a 15 percent disenrollment rate among the rest, nine points for failing the requirement and six for paperwork, which works out to about 2.3 million people in the first fiscal year. Manatt’s number, built for the plaintiff states, is that 1.8 million of the annual losses trace to the frailty restriction specifically. That 1.8 million is the pool: people with a qualifying diagnosis who cannot prove, or are never asked to prove, that the condition keeps them from eighty hours a month. Now run them through the tiers. Tier 1 gets caught ex parte if the person has claims in the lookback window and the state built the list. Tier 2 gets caught only if the state wrote the combination logic, and the deck told states to develop methodologies on historical claims, validate them with clinicians, and link the logic to eligibility systems. Most states will ship a Tier 1 code list on January 1 and a thin or empty Tier 2, which pushes a lot of Tier 2 people into Tier 3 manual review in the first half of 2027. That forecast remains an assumption, not an established fact. Over time the Tier 2 logic gets built, by the incumbents and by plans feeding encounter data, and the manual pool shrinks to its structural floor: people with no recent claims, people whose severity is invisible in codes, people in recovery under five years, and people in states that chose a narrow list on purpose, which Montana’s Medicaid director described as the goal.

What Tier 3 needs is not navigation. The IFC says states may accept documentation from physicians, nurse practitioners, physician assistants, psychologists, counselors, therapists, clinical social workers and other practitioners the state credentials, under state scope-of-practice law. That is a licensed signature on a functional standard, and it is the one input in this whole apparatus that a state cannot automate, a plan is barred from producing, and an AI phone agent cannot sign. Then there is the other half of the need, which has nothing to do with frailty definitions. Six points of CMS’s fifteen are procedural, about a million people a year who get terminated for a missed notice, and expansion adults now face redeterminations every six months, so the paperwork miss rate roughly doubles. Every one of those terminations has a provider somewhere who would pay to reverse it with retroactive coverage. Reinstatement is the product that survives any court ruling and any state’s choice about self-declaration, and it is the product that produces the data everyone else will want. The timing of demand is lumpy. 2027 is a reinstatement year everywhere and a documentation year only in North Carolina, Utah and whichever states opt to require documents instead of a signature. 2028 is a documentation year everywhere, forever, on a twelve-month cycle. A plan built for August’s version of the market would have hired clinicians for the wrong year.

Why competing with Fortuna is the wrong business

Fortuna is the funded occupant and the facts are not close. a16z Bio + Health led a $4 million seed in November 2023 and then an $18 million Series A in July 2025, with the raise pitched explicitly as a response to federal cuts and work requirements. The company says it is in 21 states with 185,000-plus patients, that it is available only through providers and insurers, that it runs licensed navigators 24/7 in multiple languages with a virtual mailbox, and that it clears 95 percent of applications and lifts renewal rates 15 percent. Its payer customers collectively cover more than 25 million Medicaid lives. Its hospital channel runs through Cedar, where the pitch is self-pay conversion and cutting uncompensated care. In October it announced AI-enabled phone renewal support with Highmark Wholecare and an entry into West Virginia with Highmark Health Options, and it is giving away an HR1 readiness model to any health plan that asks. That is a company that has already won the layer it chose.

The layer is also commoditizing underneath it, which is the second reason not to enter. States are required by the IFC to do outreach themselves. Michigan hired more than 400 people and put $12.25 million into community navigator grants. Legal aid does appeals for free. Ten eligibility incumbents - Accenture, Acentra, Conduent, GDIT, Deloitte, Gainwell, Maximus, Curam, Optum and RedMane - pledged $600 million in free or discounted services, and CMS built an open-source tool called Emmy so a state can skip the vendor entirely. MedicaidKeeper sells a reporting portal at a dollar per enrollee per year. Consent-based income verification runs about three dollars a check. When free is the competitor, a margin percentage is not a moat, and a second navigator launching 18 months late, during the exact wave the first one was built for, becomes the second-best Medicaid navigator, which is a LinkedIn headline and not a company. Add the investor problem: the firm that funds Medicaid navigation already owns the winner, so the only check available to a clone is a worse one. And add the strategic tell. Fortuna’s September post on the guidance reads the tiers as a move away from doctors’ interpretations and self-attestation toward code-driven approvals, and expects manual review and provider certifications to spike only if states fail to build their data systems. That is a company betting on the data-first world and planning to live in it. It is not hiring a medical director.

What Fortuna has and what it is missing

What Fortuna has is everything the clinical layer would otherwise have to build and should not. A consumer front door that members already use. Navigators who are licensed to enroll and who are the member’s phone number for the whole case. The state submission plumbing for applications, recertifications, appeals and state actions in 21 states, which is a lot of forms and a lot of fax. Plan contracts and the plan relationships. The Cedar channel into hospital revenue cycle. Twenty-one state form libraries. An AI phone agent that will do the first renewal call at scale within a year. For a company whose product is a certification packet, that is the distribution, the member relationship and the filing channel, pre-built, by someone who would rather partner than build the next piece.

What it is missing is the next piece. There is no publicly documented medical director, licensed clinician workforce or functional impairment assessment standard keyed to the five statutory categories. There is no publicly documented state-by-state frailty rules library that says which conditions sit in which tier, which states require documents in 2027 versus take a signature, what the form looks like, where it goes, and how long the appeal clock runs. There is no publicly documented fair-hearing representation with clinical evidence. There is no False Claims Act-grade QA, because nothing Fortuna does today could be a false statement to a government program; a certification that someone cannot work eighty hours could. And there is no conflict-safe product for plans on frailty specifically. The IFC bars plans and any contractor with a financial relationship to a plan from determining compliance, and restricts delegation of formal noncompliance notices, while permitting outreach, education, referrals and sharing information on members’ health conditions, including medically frail status. That is a narrow doorway, and the product that fits through it is evidence assembly and information sharing, not an exemption bounty. Fortuna’s own post names both missing pieces without naming them: it wants to help members understand what documentation and data to submit for frailty, even under self-attestation, and it wants to help plans incorporate newly established exclusion methodologies into care management. The first requires the rules library. The second requires the clinical layer. Neither is publicly documented as existing in the building. One more gap: Fortuna’s provider motion is hospital self-pay conversion. FQHCs and CCBHCs, where Medicaid is the majority payer and the expansion adult panel is the business, are white space for Fortuna and for everyone else.

The partnership, piece by piece

The workflow starts where Fortuna already starts, at the renewal, which now comes every six months. The navigator - or the phone agent - screens for exclusions in the order the deck recommends, the easy ones first: parent of a child thirteen or under, pregnancy, tribal status, SNAP or TANF compliance. Frailty comes last because it is the one most likely to need a document. At that point the rules engine, which is the shared asset covered in the next section, answers one question for that member in that state in that year: will the state’s own data catch this person. If the engine says Tier 1 with claims in the window, nobody does anything, because the customer is paying for outcomes and not for redundant paperwork. If the state takes a self-declaration and the member can sign one, Fortuna handles it the way it handles any form today. If the state requires documentation, which is North Carolina and Utah in 2027 and everyone from 2028 once the single declaration is used up, or if the state’s data are not reasonably compatible with what the member says, the navigator hands off. The handoff is an API call with consent attached, including 42 CFR Part 2 consent where the condition is an SUD, because that record has its own rules and a lot of the Tier 3 pool is behavioral.

The clinical layer takes it from there. It pulls the claims and problem list, through Fortuna’s data where Fortuna has it and through the provider’s where it does not, and schedules a telehealth functional assessment with a licensed clinician from the practitioner types the IFC allows. The workforce is rented, not hired. OpenLoop-class networks run clinicians licensed in all fifty states, credentialed with hundreds of payers including Medicaid, with scheduling, video and an EHR under a white label, and OpenLoop in particular spent August expanding into payer and health-system programs for complex conditions, so a Medicaid documentation program is not off thesis for the vendor either. Where a state insists on the treating provider’s signature, the clinical layer switches modes and drops a prepared packet into the FQHC clinician’s queue for a one-click e-sign, which is cheaper for everyone and is the mode that makes health centers the natural direct customer. The output is a state-formatted certification keyed to that state’s standard, QA-sampled by the medical director, with every acceptance and denial logged. The packet goes back to Fortuna, which files it through the channel it already runs and watches the notice. If the state denies, the clinical layer owns the reconsideration and the fair hearing, with a non-attorney representative where the state allows one and the clinician available to testify. The navigator stays the member’s contact the entire time. The member never learns the clinical company’s name, which is the point of a white label.

Reinstatement runs on the same rails from a different entry point. Fortuna’s hospital channel sees the uninsured ED patient three weeks after a procedural termination; the clinical layer builds the retro-coverage case and the hearing packet, Fortuna’s navigator files the reapplication and the hearing request, and the hospital pays on the restored coverage. The same API is offered, non-exclusively, to the hospital eligibility vendors, Elevate, Firstsource, R1, Conifer, whose financial counselors have the hospital paper and no clinicians, and to the state-side incumbents whose caseworker portals will soon have a button that says request provider documentation. Fortuna gets launch-partner status, first access to new states, and pricing nobody else gets. In exchange the clinical company signs the non-compete that makes the partnership possible: no consumer app, no navigators, no renewal product, no PMPM navigation contracts with plans, ever. It sells direct only to providers that have no navigator, and it tells Fortuna when it does.

The rules engine as the shared asset

The engine is a per-state shadow of the process CMS just described. For each state it holds the condition list and the tier mapping, which the state must publish and keep auditable anyway; Nebraska’s nearly 300-page index of diagnosis and procedure codes is the maximalist version, Montana’s deliberately narrow list is the other, Washington’s claims and utilization approach with a provider collection process still being designed is the middle. It holds the five statutory categories operationalized into assessment templates, including the SUD rule that stable recovery means five or more years and the serious or complex condition definition CMS borrowed from the Institute of Medicine. It holds the lookback rules, the documentation versus self-declaration policy by state and by year, the forms, the submission channel, the appeal clocks, and the early implementation dates. It holds the code logic across ICD-10, CPT, HCPCS, NDC, revenue and place-of-service codes that lets it predict a tier from claims, which is the same logic the deck told states to build, validated the same way, against historical claims with clinicians looking over the output. And it holds the thing nobody else will have: the feedback loop. Every packet filed and every state decision comes back into the engine, so the acceptance rate by state, by category, by signing clinician type and by packet format becomes the asset. A state that accepts an NP’s telehealth certification for a disabling mental disorder but bounces the same packet for a serious or complex condition unless the treating provider signs is not a rumor, it is a row in a table, and that row is worth more than the clinician who produced it.

Why Fortuna wants this instead of building it is simple. The engine answers the member’s question, what do I need to send, and the plan’s question, which members are likely excluded and what is the cheapest action that keeps them enrolled, without Fortuna standing up a clinical team or a medical director or an FCA program. It plugs into the phone agent as a decision at the end of a call. It gives Fortuna’s plan customers the care-management integration its own post promised. Why it is defensible is also simple: the data only exist for whoever files packets in 2027, nobody gets 2027 twice, and states are being told to validate their methodologies with clinicians and would rather license a validated one than hold a workgroup. Governance is the one place to be unsentimental. The data can be shared. The standard cannot. The clinical company’s medical director owns the functional impairment rubric, publishes the acceptance and denial rates, and is the person who tells a customer that most of its at-risk roster does not qualify. That last sentence is the FCA program in one line, and it is the reason the partnership is safer for Fortuna than building: a navigator that starts certifying impairment inherits a relator problem, and a navigator that routes the question to a published standard does not.

Who pays and how the money moves

Providers pay first and most simply. An FQHC with twelve thousand expansion adults on its panel loses PPS encounter revenue and 340B margin every time a patient drops, has no staff for a thirty-minute functional assessment, and has never bought a contingency service because HRSA funded its enrollment assisters. The contract is still an easy one: a roster in, an at-risk list back within a week, four hundred to five hundred dollars per patient who stays covered, nothing otherwise, and the health center’s own clinician signs where the state wants a treating provider, which makes the packet cost close to software. CCBHCs are the same deal with a sicker panel and a better exclusion rate. Hospitals pay for reinstatement with retroactive coverage; on paper they have signed with eligibility vendors for twenty years, and they pay whether the referral comes through Fortuna’s Cedar channel or through Elevate’s financial counselors.

Plans pay through Fortuna, and the structure matters more than the number. A plan’s finance team can calculate retained capitation to the dollar, six to eight thousand a year for an expansion adult in most states, and would happily pay per exemption. The IFC’s conflict rules make that the wrong invoice. A contractor with a financial relationship to the plan cannot be the one determining compliance, so the thing the plan buys is outreach, evidence assembly and information sharing, priced per packet delivered, not per exemption won, with the state making the determination it was always going to make. Fortuna already holds the plan contract and the PMPM; the clinical layer is a per packet line item inside it. That is also the working capital answer. Contingency pays sixty to one hundred twenty days after the work; per packet pricing through a partner pays on delivery, and a company doing assessments in October and getting paid in January needs some of each. States pay last and slowest. The deck created a specific state need, Tier 3 manual review surge, and the money is there at a 90 percent federal match for eligibility system development and 75 percent for operations, but it flows through Deloitte, Gainwell and Maximus. The clinical layer’s route is a subcontract when the fair hearing backlogs become a news story in the spring, not a procurement now. On unit economics, the August numbers held up better than the August timeline did: a five hundred dollar fee against ninety to one hundred ten dollars of fully loaded cost per completed determination, divided by a seventy percent acceptance rate because only accepted packets get paid, lands around one hundred forty to one hundred sixty per paid outcome. Reinstatements run thinner, a few hours of a representative’s time and a coin flip at the hearing. The 2028 reverification cycle reuses everything at a lower price per event and recurs for as long as the statute does.

Beachheads and the first hundred days

The map draws itself once the self attestation rule and Fortuna’s footprint are laid over each other. North Carolina and Utah barred first year self attestation, both go live January 1, and both are states Fortuna already operates in, which makes them the only places in 2027 where the full partnership runs end to end: navigator, handoff, certification, filing, hearing. North Carolina’s Medicaid director called the frailty guidance a curveball and said the state had to go back to the drawing board on linking frailty to ability to work, which is a state that will take help. Nebraska and Montana are the other kind of beachhead. Terminations there are not projections, they are mail, with Montana’s grace period ending in October, and Fortuna is not in either state, so the health center contracts go direct and the reinstatement data start now. Arkansas and Iowa come next as their dates arrive. Everything else waits for 2028, when documentation becomes mandatory everywhere and Fortuna’s twenty one states become the distribution plan.

The first hundred days are mostly not software. The medical director gets hired before anyone else, ideally someone who spent years doing SSDI consultative examinations, because the functional standard in the rule reads like a cousin of the Social Security listings and the people who know how to document against it have been doing it for the SSA. The rules library gets built for six states with a Medicaid eligibility lawyer reading each state’s manual line by line, which is a two week job per state and about twenty thousand dollars of counsel apiece. Three FQHCs and a CCBHC sign BAAs and send rosters, and the at risk list comes back inside a week. Twenty packets get filed through the partners’ own clinicians before the engine is pretty, because the only way to learn that a state rejects a form for a field and not for the medicine is to be rejected. The Fortuna pilot gets specified as an API, a consent flow and a Part 2 consent flow, with the phone agent handoff designed in from the start so the clinical layer is a decision at the end of a call and not a separate program. By March the reinstatement volume from the first post January renewals in Nebraska and Montana is real and measured. By the third quarter the 2028 plan is being written with Fortuna’s plan customers, because the plans are the ones who will fund documentation at scale, and the plans will want to see 2027 acceptance data before they do.

Where the partnership breaks

The court breaks it first if it breaks at all. If Judge Stearns vacates the impairment test, frailty reverts toward the diagnosis categories Congress wrote, Tier 2 collapses into Tier 1, and the clinical layer shrinks to the no recent claims residue. CMS would appeal and the First Circuit might stay the ruling, which means uncertainty through go live rather than a clean answer, and uncertainty is survivable because reinstatement does not care about the frailty definition and the engine still answers the member’s question in a diagnosis only world. The business gets smaller, not gone, and a partner who already has the distribution loses less than a company that built its own.

States break it second by making documentation trivial. Washington’s HCA says it will work with healthcare professionals through 2027 to find the least burdensome way to collect provider information, and a state that ships a five minute provider attestation portal has just turned the treating provider mode into the whole market. The clinical layer’s value then compresses to outreach, triage and hearings, which is still a business, and the engine’s job becomes knowing which states built the portal and which did not. Fortuna breaks it third by building in house. The defense is to make buying cheaper than building: the medical director, the published rates, the 2027 acceptance data and the FCA program are expensive to replicate and unpleasant to own, and the non exclusive deals with the hospital eligibility vendors are the insurance policy if the partner decides to own the last mile anyway. The incumbents break it fourth by adding a request provider documentation button to the caseworker portal; the answer is to be the vendor on the other end of that button rather than to fight it. Then the line that breaks everyone who crosses it. A certification that overstates impairment to secure an exemption is a false statement to a government program, CMS is in an enforcement mood, and a company doing it at scale is a relator’s retirement plan. The medical director owns the standard, the company publishes its denial rate alongside its acceptance rate, and it walks away from any customer who asks for a different answer. The last break is the one the August essay underweighted: 2027 self attestation means the documentation wave is a year later than it looked, and a company that hires several hundred clinicians for January 2027 will be paying them to wait.

What has to be true by January

Not much, and all of it checkable. A Fortuna pilot signed in North Carolina or Utah with an API spec and a consent flow. Three to five health center contracts in Nebraska and Montana on contingency, with rosters in and at risk lists out. A medical director with a disability determination background and a written functional impairment rubric. A rules library for six states that a lawyer has read. Twenty filed packets and the acceptance rate they produced, whatever it is. One reinstatement won at a hearing in a state where terminations already happen. A False Claims Act program that exists on paper before the first contingency invoice does. A published methodology, because the state workgroups the deck told states to convene need something to validate and would rather validate a vendor’s than write their own.

If those are true in January, the 2027 reinstatement year funds the 2028 documentation year, the engine learns from every state decision in between, and Fortuna’s twenty one states become the map instead of the competition. If they are not true, the partnership was a slide and the market will find out whether Elevate’s financial counselors or a state portal gets there first. The guidance is posted. The hearing is October 20. The deadline has not moved. The missing piece is still a company, except now it has a name for the company it should call first.

Nebraska went live May 1. Montana launched July 1. North Carolina and Utah barred self-attestation in year one. The documentation wave is real and already started.

Fortuna Health owns the navigation layer: 21 states, 25 million-plus Medicaid lives, a16z money, a hospital channel through Cedar. Building a second navigator is a price war with free.

The business that exists is the clinical layer behind Fortuna: a state-by-state rules engine, licensed clinicians for tier three packets, and a reinstatement shop. The missing piece is still a company.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Nebraska went live May 1. Montana launched July 1. North Carolina and Utah barred self-attestation in year one. The documentation wave is real and already started.

Fortuna Health owns the navigation layer: 21 states, 25 million-plus Medicaid lives, a16z money, a hospital channel through Cedar. Building a second navigator is a price war with free.

The business that exists is the clinical layer behind Fortuna: a state-by-state rules engine, licensed clinicians for tier three packets, and a reinstatement shop. The missing piece is still a company.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Trey’s Thoughts on Healthcare Markets & Technology

Part I: Ohio's CHOICE Push and the ICHRA Business Opportunity: Where Entrepreneurs Can Build in Employer Benefits, Insurance Payments, Drug Coverage, Provider Networks, and Broker Distribution

Ohio just hosted a federal event pushing CHOICE arrangements (individual coverage health reimbursement arrangements). The press conference is the least interesting part of the story…

Listen now

5 days ago

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Trey’s Thoughts on Healthcare Markets & Technology

Part II: Ohio's CHOICE Push and the ICHRA Business Opportunity: Where Entrepreneurs Can Build in Employer Benefits, Insurance Payments, Drug Coverage, Provider Networks, and Broker Distribution

Ohio just hosted a federal event pushing CHOICE arrangements (individual coverage health reimbursement arrangements). The press conference is the least interesting part of the story…

Listen now

5 days ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

Federal promotion of CHOICE arrangements, previously known as individual coverage health reimbursement arrangements, is giving an existing benefits model a much bigger sales platform. Employers fund a defined contribution, employees choose individual insurance, and a surprising amount of work appears between those two steps. Entrepreneurs can build businesses around employer evaluation, benefits administration, premium payments, insurance distribution, and clinical coverage matching. The economics deserve scrutiny, though. Employer savings can come from shifting costs to workers, individual insurance networks can disrupt treatment, and administrative revenue can disappear into support expenses. The strongest businesses will solve specific operational problems, demonstrate value through renewals, and establish distribution without spending every dollar of margin acquiring the next customer.

Table of Contents

Ohio’s announcement and the business underneath it

The savings claim needs a second spreadsheet

Compliance is part of the product

Sell the employer a decision it can defend

Build the machinery that keeps coverage active

Help employees buy coverage they can actually use

Distribution decides whether the business works

The consequences for insurers, providers, and pharma

What the revenue model has to survive

Where a founder should start

Ohio’s announcement and the business underneath it

A home care company with several hundred employees has a fairly practical definition of healthcare innovation: something that makes next year’s benefits renewal less miserable without causing its best nurses to quit. That company probably doesn’t care whether the solution is called an individual coverage health reimbursement arrangement, an ICHRA, or a CHOICE arrangement. It cares about the monthly bill, whether employees can keep their doctors, and who answers the phone when somebody’s insurance disappears. Those concerns explain the entrepreneurial opportunity better than the branding does. Replacing a group insurance purchase with hundreds of individual insurance decisions creates work. Some of that work can become good software. Some will stubbornly remain people answering complicated questions during dinner.

The October Ohio event brought together CMS, the Small Business Administration, Take Command, employers, and other industry participants to promote CHOICE arrangements. The announcement describes a renamed version of the existing ICHRA structure. It doesn’t establish a separate Ohio insurance program or announce a new Ohio subsidy. Its commercial significance is federal attention and a more active effort to get employers considering the model. For a founder, that can help open conversations, although a government press conference has never completed a payroll integration. The underlying arrangement lets employers reimburse qualifying individual health insurance or Medicare coverage while employees select their coverage. An employee can generally keep the individual policy after leaving a job, provided the premiums keep getting paid. The employer’s contribution doesn’t automatically travel along.

There’s evidence of a growing market, with caveats that matter to anyone sizing a business. Industry reporting for twenty twenty-six identified more than twenty thousand employers offering either ICHRA or qualified small employer arrangements, and estimated ICHRA-covered lives alone exceeded five hundred thousand. The underlying HRA Council reporting identified 261,000 participating employees and 402,000 known covered lives as of January 2026, then estimated total ICHRA-covered lives above five hundred thousand after accounting for incomplete vendor coverage. Adoption among applicable large employers more than doubled on an aggregated basis, although the most conservative returning-provider comparison showed 34 percent year-over-year growth. Those findings aren’t a complete national census, and employer counts across different reimbursement arrangements shouldn’t be treated as interchangeable. A founder still needs to establish how many employers are reachable, how many employees will actually enroll, and which existing vendors already serve them. A growing category can support plenty of businesses. It can also support plenty of fundraising decks for businesses selling roughly the same thing.

The savings claim needs a second spreadsheet

The pressure behind employer interest is easy to understand. Average annual employer-sponsored premiums in twenty twenty-five reached nine thousand three hundred twenty-five dollars for single coverage and twenty-six thousand nine hundred ninety-three dollars for family coverage. Family premiums had increased six percent over the preceding year. Those are total premiums, including employer and worker contributions. Against that backdrop, a predictable employer contribution has obvious appeal. But predictable spending and cheaper healthcare are different economic outcomes. A company can make its benefits expense predictable by fixing its contribution while employees absorb future premium increases. Nothing about that arrangement, by itself, reduces the price of an infusion, a hospital admission, or a specialty prescription.

Consider an illustrative employer with three hundred participating workers, currently spending eight hundred dollars per worker each month. Suppose it replaces that expense with a six hundred fifty dollar monthly allowance and thirty-five dollars in administration fees. Assuming full allowance use and unchanged participation, the annual employer savings would be four hundred fourteen thousand dollars. That’s real budget arithmetic. Whether workers benefit requires another analysis. Their new premiums, deductibles, prescription costs, and access to care might improve, deteriorate, or vary sharply across households. A younger employee could get a better deal while an older colleague with family coverage faces a substantial increase. Excel is remarkably good at making someone else’s deductible disappear.

Ohio also illustrates why historical marketing claims need expiration dates. A widely circulated Ohio analysis published in August of twenty twenty-one described three hundred forty-four individual plans statewide and quoted reimbursement and premium figures from that period. Those numbers aren’t current underwriting inputs, and a statewide plan count doesn’t describe the choices available at a particular employee’s address. A useful employer comparison would use current local premiums and evaluate the actual workforce against the current group plan. It would also distinguish a company introducing benefits for the first time from one replacing established coverage. The former is buying an improvement over its existing benefit offering. The latter has employees with doctors, authorizations, accumulated expectations, and strong opinions about losing any of them.

Compliance is part of the product

An ICHRA isn’t an unrestricted cash allowance with a tax-friendly label. Employers have to design the arrangement within rules governing eligibility, employee classes, and reimbursement. They can offer traditional group coverage to one permitted class and an ICHRA to another, but can’t simply let employees within the same class choose between the two. Certain mixed arrangements trigger minimum class sizes. Contributions generally must follow consistent terms within a class, with permitted variation for age and family size; age-based variation is limited to a three-to-one ratio. The arrangement also carries notice and substantiation requirements, including generally providing written notice at least ninety days before the plan year begins. These details create a useful software problem because the answer depends on the employer’s configuration. A generic document generator won’t catch a class definition that becomes invalid after somebody changes eligibility in the payroll system.

The interaction with premium tax credits deserves especially careful engineering. An employee offered an affordable ICHRA generally can’t receive a marketplace premium tax credit. If the offer is unaffordable, the employee must decline the arrangement to pursue a credit, subject to the other eligibility rules. Accepting the reimbursement arrangement and adding a marketplace subsidy isn’t a clever funding strategy. It’s an eligibility error. For twenty twenty-six, the affordability calculation compares the employee’s cost of the applicable lowest-cost silver coverage after the employer allowance with nine point nine six percent of household income. Employer compliance safe harbors can use different permitted assumptions, including worksite location and specified premium lookback rules. Software should preserve the distinction between determining an employer’s compliance position and evaluating a particular household’s subsidy eligibility.

There are product opportunities in maintaining those distinctions over time. A worker changes address, gets married, moves between employment classes, or receives a different allowance. Each event can affect the next decision. The system should record the applicable rule, the data used, the employee’s election, and the effective date. It should also handle the difference between marketplace and off-exchange enrollment: pretax payroll deductions for an employee’s remaining individual premium generally require off-exchange coverage. This is work for explicit rules and auditable calculations. A language model can help read documents or explain an outcome, but the calculation itself needs to be reproducible. Nobody wants an affordability determination that changes because the chatbot felt more optimistic after lunch.

Sell the employer a decision it can defend

A promising entry point is helping brokers and employers decide whether to switch before trying to administer the resulting benefit. The product would ingest an employee census, the current contribution schedule, renewal pricing, and benefit information. It would then compare realistic contribution designs against the plans available where employees live. Public exchange data already cover premiums, benefits, and geographic availability, alongside lowest-cost silver lookup resources for ICHRA analysis. Access to those files isn’t much of a competitive advantage. Resolving messy employee records, distinguishing plan years, handling geography correctly, and showing a defensible comparison could be. The buyer needs to understand what the move does to the workforce, including the employees for whom the average result is misleading.

The output should expose the distribution of outcomes. An employer might accept modestly higher spending to protect employees who would otherwise face a large increase. It might exclude a proposed transition because available networks would disrupt too much care. It might discover that a different contribution design works for one permitted employee class while group coverage remains attractive elsewhere. A strong analysis would show household premium changes separately from expected medical spending and worst-case financial exposure. It would explain uncertainty where information is incomplete. That last part matters because small employers may lack usable claims history, and employee-reported healthcare needs are neither complete nor a license to promise precise spending forecasts.

Commercially, this could begin as paid implementation analysis and become an annual broker subscription or employer planning product. The renewal cycle creates repeated demand even when the employer stays with group coverage. That gives the business a reason to exist beyond convincing everyone to convert. It also creates an incentive question: an administrator paid only after migration may be tempted to produce optimistic recommendations. A broker-facing evaluation business can differentiate through comparisons that occasionally conclude the employer should stay put. Over time, its useful proprietary data would be the difference between projected and realized outcomes: which comparisons predicted enrollment, where employees needed assistance, and which employers regretted the switch.

Build the machinery that keeps coverage active

After the employer approves the change, the transaction problem arrives. Group administration lets an employer operate around a relatively consolidated insurance relationship. Individual coverage introduces separate applications, member identifiers, payment obligations, carrier systems, and household changes. An employee can select a plan without completing every step needed for active coverage. A payment can leave one account without being correctly applied to the intended policy. Those distinctions are easy to flatten into a single green status indicator, especially when a product team is trying to make the screen look reassuring. A useful operations business would preserve them. Application submitted, enrollment accepted, initial premium received, and coverage confirmed should be separate states with clear evidence behind each.

The product could give employers one consolidated funding workflow while maintaining a detailed ledger beneath it. Each employer contribution and employee deduction would reconcile to a policy, coverage period, and carrier receipt. Exceptions would have owners and deadlines. Returned payments, incorrect deductions, duplicate submissions, and retroactive adjustments would move through defined processes instead of disappearing into shared inboxes. The commercial buyer could be an administrator, broker platform, payroll provider, or insurer. Charging for reconciled enrollment or active employee months would tie revenue to ongoing work. The difficulty is integration: a founder can’t assume every carrier exposes reliable payment and coverage information through a convenient interface. The business needs a workable path for the carriers that still require manual follow-up.

Cash timing deserves its own design. If employees must pay the full premium before receiving reimbursement, the arrangement can create a real liquidity problem. Direct payment can reduce that burden, but someone still has to collect funds on time and handle a shortfall. Advancing premiums introduces financing and loss exposure that should be priced deliberately. Operational metrics should therefore include confirmed coverage, unresolved payment exceptions, reimbursement delays, and preventable lapses. This is also where defensibility could develop. An administrator is unlikely to replace a reliable reconciliation system casually once it handles thousands of policies and years of transaction history. Getting there requires patient operational work, including a lot of unglamorous carrier conversations.

Help employees buy coverage they can actually use

A plan comparison tool becomes much more valuable when it understands the difference between a cheap premium and usable coverage. Consider a hypothetical worker taking an infused biologic who wants to keep an established specialist. Checking the drug’s name against a pharmacy formulary won’t answer the whole question. The treatment may run through the medical benefit, depend on site-of-care rules, require a new authorization, and involve a facility whose network status differs from the physician’s. A useful recommendation needs to identify those uncertainties before enrollment. Similar problems arise with durable medical equipment, behavioral health appointments, specialty pharmacies, and scheduled procedures. A plan can look suitable in a summary and still create a nasty operational surprise.

There is already public infrastructure to build on. Provider and formulary data specifications connect qualified health plans with provider networks and covered drugs through machine-readable files. The entrepreneurial work would be validating, supplementing, and maintaining the information needed for specific decisions. Matching a physician’s name isn’t enough when participation depends on location or a particular product network. A formulary entry doesn’t settle every question about indication, utilization management, pharmacy restrictions, or patient cost. The product should distinguish verified information from an unresolved lookup and route consequential uncertainty to a person. A platform that can explain exactly what was checked, when it was checked, and what remains unknown has something worth selling.

This service could be embedded within an administrator’s enrollment experience, sold to brokers, or contracted through providers that regularly help patients navigate coverage changes. Medication and treatment details should remain separated from the employer’s ordinary management view; employers usually need aggregate information about disruption and benefit adequacy, not a searchable inventory of employees’ conditions. The recurring opportunity extends beyond enrollment. Plans change, clinicians leave networks, and workers develop new needs. A renewal review that detects a threatened treatment relationship could justify a continuing fee. Performance should be measured through resolved coverage problems, successful transitions, and useful verification, with appropriate limits on what the vendor can guarantee. The number of recommendations generated is mostly a measure of how often the software was asked a question.

Distribution decides whether the business works

There are already administrators and technology companies in this market, including Take Command, Thatch, Remodel Health, and Zorro. A new founder is entering an occupied category. A polished enrollment interface alone is unlikely to overcome incumbent relationships, established operations, and broker familiarity. Distribution deserves attention before a large product build. Brokers have employers approaching renewal, payroll providers have ongoing relationships and relevant workforce data, and industry-specific software vendors may already reach a concentrated customer base. Each channel has different incentives. A partner agreement that never produces a submitted employer census is essentially a very formal expression of mutual enthusiasm.

A focused industry strategy could improve the economics. Home care agencies, dental groups, restaurants, and regional service businesses have different staffing patterns and different operational systems. A founder serving one segment can build around its hiring practices, payroll schedules, employee communication needs, and renewal decisions. Healthcare services could be attractive because benefits affect recruitment while employers often have limited room to absorb higher expenses. But the workforce still needs individual evaluation. Lower-paid employees may already qualify for meaningful marketplace assistance, and an employer contribution can change that eligibility. A vertical sales pitch that ignores the household’s existing position can turn a well-intended benefit into a source of complaints.

The broker’s economics also need to work. A transition may change commission income, increase individual enrollment work, and create more support questions. Software that reduces that work can justify a fee, while an administrator that simply hands the broker a larger workload may struggle to retain the relationship. Compensation should be transparent, and plan recommendations should remain useful when carrier compensation differs. A practical launch would involve a small group of brokers and employers willing to work through actual renewals. The evidence to watch is conversion from evaluation to implementation, participation after rollout, support demand, and retention at the next renewal. Those results say much more than a long list of prospective channel partners.

The consequences for insurers, providers, and pharma

For insurers, employer-funded individual enrollment creates a different acquisition channel and potentially different retention patterns. Industry data for twenty twenty-six showed that more than half of observed enrollments, on and off exchange, involved employees younger than forty-five. That is an interesting demographic observation, not proof of superior underwriting profitability. A carrier still needs to evaluate morbidity, utilization, premiums, acquisition costs, and applicable risk adjustment transfers. A business could help insurers reconcile employer-originated enrollment, understand persistence, and forecast service demand. The proposition should be better operational and actuarial information. Assuming that employer affiliation automatically produces attractive medical margins would be a pretty expensive shortcut.

Providers face a different exposure. If a local employer moves workers into individual products, its employees may land in networks with different participating facilities and reimbursement arrangements. A health system could lose established patients despite those patients believing they kept the same insurance brand. A specialty practice might discover the problem only when it checks eligibility before treatment. Entrepreneurs could build coverage transition services that verify upcoming insurance, identify network conflicts, and help patients complete required steps. The business case would depend on fewer disrupted appointments and cleaner financial clearance. Provider-sponsored plans might also evaluate employer-funded individual coverage as a distribution channel, although concentrated enrollment would still require disciplined pricing and network design.

For pharma and pharmacy benefit businesses, the employer’s change in funding doesn’t automatically create a new right to control drug purchasing. Employees select individual policies with their own coverage arrangements. A startup can’t assume it can attach a separate pharmacy contract to every policy an employer helps fund. More practical opportunities involve treatment continuity, benefit verification, and assistance workflows during coverage transitions. A specialty pharmacy or manufacturer service provider could pay for fewer abandoned starts and fewer avoidable delays, provided the service demonstrates that value. Any plan-selection product funded by a manufacturer would need to make that relationship clear and protect the integrity of its recommendations. Otherwise, a coverage tool risks becoming a promotional channel wearing a benefits badge.

What the revenue model has to survive

Premium volume can make an administrative business look much larger than it is. Take an illustrative platform serving ten thousand employees at thirty-five dollars per employee per month. That produces four point two million dollars in annual administrative revenue. If six hundred fifty dollars per employee also passes through the platform each month, the annual premium flow is seventy-eight million dollars. Those funds aren’t automatically the platform’s revenue or margin. The commercial analysis should separate administration fees, insurance commissions, payment-related income, and any financing economics. It should also specify whether the vendor charges for eligible employees, enrolled employees, or active policies, because participation and turnover affect each model differently.[Tool budget: round 1/1; 0 rounds remain afterward.]

Support costs can eat through the apparent software economics. Using another hypothetical assumption, twelve dollars per employee each month for service labor plus five dollars for payments, data, and infrastructure would leave eighteen dollars from the thirty-five dollar fee. That’s roughly fifty-one percent gross margin before corporate overhead, assuming all those costs are classified consistently. Broker payments or heavier support demand could reduce it further. Automation helps when it resolves repeatable work accurately. If every exception requires a specialist and each carrier connection needs custom maintenance, the business may operate more like an administrative service company than its presentation suggests. That can still be a good business. It just needs pricing, staffing, and a valuation that acknowledge the work.[Tool budget: round 1/1; 0 rounds remain afterward.]

Where a founder should start

The best starting point is not a broad promise to modernize employer health insurance. It is a narrow operational failure with a measurable consequence. A founder might begin with contribution and plan analysis for a specific employer segment, coverage reconciliation for a defined administrator workflow, or treatment-continuity support during enrollment. The first customers should be willing to expose the real exceptions, not just admire a clean demonstration. A product that cannot show what happened to an employee’s application, payment, network question, or unresolved case will struggle to earn trust when the benefit becomes personal.

The market is now large enough to attract serious competition, but not mature enough to remove the basic execution problems. More than twenty thousand businesses reportedly offered ICHRA or QSEHRA arrangements in 2026, while ICHRA-covered lives exceeded five hundred thousand; those figures describe momentum, not guaranteed customer demand or profitability. The federal rebranding of ICHRA as CHOICE may increase awareness, but awareness will not reconcile a failed payment or preserve a disrupted specialist relationship. The durable opportunity belongs to companies that make the defined-contribution model work in practice, price the human support honestly, and prove at renewal that the benefit helped more than it merely shifted risk.

Renewal is the real test. Employees age, contributions change, carriers reprice products, and employers reconsider budgets. A business dependent on a favorable comparison in its first year needs to show what happens when that comparison deteriorates. Data rights also deserve scrutiny: an administrator shouldn’t assume it can obtain comprehensive clinical claims data merely because it helps fund premiums. The product has to work with information it can legitimately access and maintain. Investors should examine retention by employer cohort, actual enrolled months, service costs through open enrollment, carrier concentration, and the gap between forecast and realized savings. Growth that requires increasingly expensive cleanup is a warning about the operating model, even when the enrollment chart looks excellent.

Where a founder should start

A founder with limited capital has a reasonable path through a narrow employer segment and an existing administrator. The initial offer could be paid feasibility analysis, implementation support, and a specific ongoing service such as coverage verification or payroll reconciliation. That approach generates access to real problems before committing to a full platform. The repeated work should determine what gets automated. A team with deep payment and carrier integration experience might instead build infrastructure for several administrators. A team with pharmacy or provider data expertise could focus on treatment continuity and coverage matching. These businesses require different capabilities and should be evaluated on their own economics, even though they all benefit from the same policy structure.

Early validation should involve a complete operating cycle. Employers need to move from evaluation through employee enrollment, premium payment, ordinary support, and renewal. The founder should know which tasks required manual intervention, why employees declined participation, and whether the original financial comparison held up. A provider-matching company needs evidence that its verification changes decisions or prevents disruption. A payments company needs proof that it can resolve exceptions reliably. An employer analysis product needs buyers willing to pay for an honest recommendation, including an inconvenient one. Those are concrete tests of willingness to pay and delivery cost. They are much harder to fake than interest in a webinar.

Ohio’s promotion of CHOICE arrangements gives entrepreneurs a timely reason to approach employers and distribution partners. The work available beneath that announcement is substantial: employers need sound comparisons, employees need suitable coverage, and somebody has to make the money arrive at the right insurer every month. The strongest starting point is a problem for which a buyer already spends time, loses money, or receives angry calls. Solve that problem for a defined customer group, charge enough to handle the difficult cases, and use the resulting operating history to improve the product. A business that makes the next benefits renewal less painful and keeps employees’ coverage working has a credible reason to be renewed itself

.

The market: 20,000+ employers offering some version of this model, 500,000+ covered lives, and 34% year-over-year growth among larger employers. Real numbers with real caveats.

The trap: predictable employer spending and cheaper healthcare for workers are two different outcomes. Fixing a contribution can shift every future premium increase onto employees. Spreadsheets are good at hiding that.

The opportunity: compliance rules, payment reconciliation, clinical coverage matching, and broker distribution all need purpose-built software. None of it is solved by a polished enrollment interface.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

The market: 20,000+ employers offering some version of this model, 500,000+ covered lives, and 34% year-over-year growth among larger employers. Real numbers with real caveats.

The trap: predictable employer spending and cheaper healthcare for workers are two different outcomes. Fixing a contribution can shift every future premium increase onto employees. Spreadsheets are good at hiding that.

The opportunity: compliance rules, payment reconciliation, clinical coverage matching, and broker distribution all need purpose-built software. None of it is solved by a polished enrollment interface.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Trey’s Thoughts on Healthcare Markets & Technology

Part I: Ten Businesses Worth Building on CMS-4214-P: Medicare Advantage Provider Directory Letter Grades, Part D PBM Delinking and Cost Plus Service Fees, and the $0 Dual Generic Copay in 2028

CMS filed a 265-page rule in October 2026 that ends spread-based pharmacy benefit manager pay in Medicare and grades every Medicare Advantage plan’s provider directory. Both take effect in 2028. Neither gives the industry two years…

Listen now

5 days ago

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Trey’s Thoughts on Healthcare Markets & Technology

Part II: Ten Businesses Worth Building on CMS-4214-P: Medicare Advantage Provider Directory Letter Grades, Part D PBM Delinking and Cost Plus Service Fees, and the $0 Dual Generic Copay in 2028

CMS filed a 265-page rule in October 2026 that ends spread-based pharmacy benefit manager pay in Medicare and grades every Medicare Advantage plan’s provider directory. Both take effect in 2028. Neither gives the industry two years…

Listen now

5 days ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. The Friday drop

2. Why 2028 means 2027

3. Business one: the ninety day verification machine

4. Business two: the letter grade arms race

5. Business three: the reliance ledger

6. Business four: one attestation, every plan

7. Business five: behavioral health that answers the phone

8. Business six: the ownership graph

9. Business seven: fair market value for a PBM

10. Business eight: the July 1 report factory

11. Business nine: the transparent Part D PBM and the rebate desk

12. Business ten: pharmacy network truth

13. The zero dollar copay footnote

14. What to comment on before December 15

15. Closing

Abstract

CMS filed CMS-4214-P on Oct 16, 2026, a 265 page proposed rule implementing three sections of the Consolidated Appropriations Act, 2026. Section 6220 (the REAL Health Providers Act) makes MA plans verify every directory record every 90 days, remove departed providers in 5 business days, run an annual random sample accuracy audit weighted toward behavioral health, report a letter grade that CMS publishes in machine readable form in 2029, and cap member cost sharing at in network levels when a member relied on a bad listing. Section 6224 delinks PBM pay in Part D from drug prices starting Jan 1, 2028: flat dollar bona fide service fees at fair market value (cost plus a reasonable markup), full rebate pass through, eleven categories of annual reporting due July 1, 30 day disclosure of manufacturer contracts, annual audit rights, and disgorgement that flows PBM to sponsor to CMS. Section 6219 takes the generic copay for full benefit duals under 100 percent FPL from $1.60 to $0 in 2028 for about 6 million people. Comments close Dec 15. Ten businesses follow, each built on the gap between what plans and PBMs know about themselves and what they now have to prove.

The Friday drop

On Friday Oct 16, 2026, CMS filed CMS-4214-P, a 265 page proposed rule that implements three sections of the Consolidated Appropriations Act, 2026, the funding bill signed Feb 3 that quietly carried the biggest PBM and provider directory reforms in a decade. Federal Register publication is Oct 20, comments are due 5 pm Eastern on Dec 15, and the docket is CMS-2026-2533 if you want to spend January reading 400 trade association letters that all open with the words “we applaud.” Three sections, three sizes of bomb. Section 6219 is the small one: the generic drug copay for full benefit dual eligibles at or under 100 percent of FPL goes from $1 (CPI indexed, so $1.60 in 2026) to $0 for plan years starting Jan 1, 2028, touching roughly 6 million people, no new paperwork, and the brand copay stays at its indexed $4.90 and keeps climbing. Section 6220 is the REAL Health Providers Act, which makes MA organizations verify every provider in every network based plan’s directory at least every 90 days (acute hospitals, ICUs and surgery centers get a 12 month cadence because they tend not to move), remove departed providers within 5 business days, flag anything they could not verify with a note that the info may not be up to date, run an annual random sample accuracy analysis, report a letter grade to CMS, and starting with CY2029 watch CMS post that grade in a machine readable file while the plan displays it prominently in its own directory. Also, if a member relies on a listing that says in network and the provider turns out not to be, the member pays no more than in network cost sharing. Section 6224 is the Modernizing and Ensuring PBM Accountability piece. From Jan 1, 2028 a PBM or any of its affiliates can only get paid for Part D work through bona fide service fees: flat dollar, fair market value, for an itemized service actually performed, not based on WAC, AWP, rebates, formulary placement or volume of business. Manufacturer rebates are fine only if 100 percent of them land with the plan sponsor. Add annual reports to sponsors and CMS due July 1 (first one July 1, 2028 covering plan year 2027), a written explanation of every manufacturer contract delivered to the sponsor within 30 days of signing and certified by the CEO, CFO or GC, an annual audit right where the sponsor picks the auditor, and a disgorgement pipe that runs PBM to sponsor to CMS. CMS wrote, in its own impact table, that it cannot estimate the financial effect of the PBM piece because nobody outside the PBMs knows what the contracts say. That sentence is the whole reason the law exists.

Why 2028 means 2027

Everything above says 2028, which sounds far away and is not. CY2028 Part D bids are due the first Monday in June 2027. A sponsor cannot bid a benefit without knowing what it pays its PBM, and the PBM contract has to be rebuilt from the studs because every spread, every admin fee priced as a percent of WAC, every rebate retention clause and every GER guarantee with a mystery exclusion list is dead as of the 2028 plan year. So the actual deadline on the PBM side is spring 2027, and the RFPs and renegotiations are being drafted this winter by people who are not sleeping well. Same logic on the directory side. The first 90 day verification cycle has to complete inside Q1 2028, which means the outreach infrastructure, the provider contract amendments (the rule proposes a mandatory contract term obligating every network provider to keep its own directory info current) and the sampling methodology all need to be live by Q4 2027. CMS also noted that marketing and communications rules for CY2028 apply from Oct 1, 2027, when the annual enrollment materials go out, and the statute already set June 1, 2027 as the date CMS has to publish the standard formats for the PBM reports. For a builder that collapses a vague “2028 regulation” into a 2027 sales year with a hard calendar, which is about the kindest thing a federal agency can do for you. CMS also says a separate Parts C and D policy rule lands later this fall, so there is a second gust coming.

Business one: the ninety day verification machine

Do the arithmetic. One verification event per provider per specified MA plan every 90 days. A mid sized MAO with 60 plans across a few states carries hundreds of thousands of provider, address and phone combinations in its directories, and CMS proposes exactly that triple as the unit of a record, so a doc at two addresses is two records and a doc with two phone numbers at one address is two records. Every one of them needs a verification event four times a year, plus a 5 business day removal clock, plus the unverified flag, plus the 30 day general update rule. The rule’s menu of acceptable verification methods is basically the product spec: internal plan information (current rosters, recent claims), telephone, email, provider attestation, CMS maintained data sources (NPPES now, the NPD when it matures), claims data, and other methods CMS specifies later, a catch all CMS says it wrote on purpose because AI driven verification is moving fast. CMS also intends to rescind the two HPMS memos from Jan 3, 2020 and June 29, 2022 that let a plan off the hook if its wrong data happened to match NPPES. The NPPES safe harbor was the entire compliance strategy for a lot of plans, and CMS is pulling it with one paragraph.

So the business is an outbound verification engine: AI voice agents that call offices and get past the phone tree, email that lands with a one tap attestation, a provider facing portal, and all of it producing a timestamped, method tagged evidence record per element per cycle that a plan can hand a CMS reviewer. The economics work because the rule rewards reuse. CMS says it will let plans consolidate samples across the organization so a provider in 12 of the org’s plans gets one email, not 12. Scale that across clients and the same front desk that is being hammered by 40 plans gets verified once a quarter by one vendor, and the attestation is syndicated to all 40. That is the CAQH model applied to directory elements, and CAQH’s data famously does not cover accepting new patients or telehealth, which is exactly why CMS wrote that NPPES alone will not cut it. Pricing is per record per cycle with a premium for the elements front desks hate answering (panel status, disability accommodations, telehealth). Kyruus, Veda, H1, LexisNexis, Quest Analytics and CAQH itself will all claim this; fwiw the gap is outbound capacity at scale and the evidence ledger rather than another dashboard. Between June 2022 and June 2024 CMS ran its own reviews of 142 MAOs, 11,360 providers and 18,852 locations by having humans call offices, and found 44.29 percent of location listings had at least one deficiency, with PCPs at 45.73 percent, cardiologists at 47.66, oncologists at 45.67 and ophthalmologists at 38.34. Plans already know what a CMS caller finds. That number is their 2028 grade preview.

Business two: the letter grade arms race

The scoring formula is public and weighted: network participation status 40 percent, contact info 20, address 20, specialty 10, accepting new patients 3, disability accommodations 3.5, telehealth 3.5. Scoring is binary per element (every part of the address has to match, though “st” versus “street” is forgiven), summed across the sample, weighted, rolled into a composite and translated into a letter grade. Provider name, cultural and linguistic capabilities and the new ownership disclosure sit in the directory but not in the score. CMS is still deciding on partial credit (0.5 if at least half the parts of an element are right), confidence scoring (1.0 only if two methods agree), sample size floors and ceilings, a minimum response rate, replacement of non responders, and whether sample dates are fixed, plan chosen, or randomly assigned inside a quarter to stop plans from scrubbing the week before. The sample itself is 65 percent general and 35 percent high inaccuracy specialties, and today the only high inaccuracy specialty is mental health and SUD, defined by Medicare specialty codes 26, 27, 86, 62, 68, 80, 79, D5, E1 and E2 plus a few NUCC taxonomies. CMS also restricts which methods count for which elements in the score: internal plan info and claims only prove participation and specialty, phone and email cover the six contact style elements, attestation covers everything. Attestation is the universal key, so whoever owns provider attestations owns the grade.

The business is a score engine. Ingest the plan’s directory, build the sampling frame exactly the way CMS defines a unique record, draw a compliant sample, run the verification, compute the composite under every variant CMS is still chewing on, and tell the plan its grade nine months before the audit along with the cheapest path to an A (fix participation status first, it is 40 percent of the grade and it is the one element claims data can verify for free). Layer on an independent pre audit, because once grades are public in 2029 and brokers are using them to steer enrollment, a B minus becomes a sales problem and the compliance team will pay for a second opinion. Star Ratings consulting is a nine figure industry built on a public scorecard with a published formula; this is a brand new one with a hard launch date. The gaming is obvious (cull the sketchy records before the draw, oversample easy specialties, pray for a friendly sample date) and CMS says as much in the rule, which is why it floated randomly assigned dates. A vendor that keeps a plan clean year round has a better story than one that shows up in August with a mop.

Business three: the reliance ledger

New 422.124 says an enrollee who relies on a directory listing that says in network and gets care from a provider who turns out to be out of network pays no more than in network cost sharing. Operationally that means a plan has to answer, with evidence, what its directory said on the day the member looked, and no plan can do that today. Directories are live databases that overwrite themselves; the PDF copy refreshes within 30 days, or 5 business days for removals, and then the old version is gone. So the product is a directory snapshot ledger: immutable, timestamped, queryable captures of every published directory state, paired with an intake and adjudication workflow for cost sharing protection requests that pulls the snapshot, matches the claim, reprices to in network, and tracks the delta as a reportable cost. CMS lists processing these requests as a new administrative cost in its impact table, which means plans will budget for it, which means there is a line item to sell into.

The consumer side is more fun. A member who got a surprise out of network bill from a provider the directory called in network now has a statutory remedy, and most of the 35 million or so people in MA will never hear about it. The No Surprises Act spawned bill negotiation startups; this spawns the MA version, smaller dollars per case but a cleaner legal hook, and the evidence lives in the plan’s own directory history. SHIP counselors, brokers and plaintiffs’ lawyers will want the snapshots too, which is one more reason a plan buys the ledger before somebody builds it against them.

Business four: one attestation, every plan

Flip to the provider side. The rule proposes that every MA network contract carry a term obligating the provider to maintain current and accurate directory information. Providers already ignore roster requests; from 2028 ignoring them is a contract breach, and every plan is required to pester them four times a year. A multispecialty group with 300 clinicians, 40 locations and 15 MA contracts is staring at 60 verification cycles a year, each touching hundreds of records, with outreach landing on front desk staff who have no idea what telehealth capability means for Dr. Patel on Tuesdays. The provider side product is a single source of truth for the practice (clinician, location, phone, specialty, panel status, accommodations, telehealth and now ownership) that publishes to every plan in the plan’s required format, auto answers inbound verification requests, and keeps the attestation trail the group needs when a plan tries to blame it for a bad grade. The EHR and practice management vendors are the natural owners and mostly have not bothered; the credentialing crowd (symplr, Medallion, Verifiable and friends) is adjacent. The wedge is panel status: accepting new patients is the one element only the practice knows, it changes weekly, and CMS gave it a 3 percent weight precisely because it is miserable to maintain. Get the practice to maintain it once and you can sell it to every plan in the market.

There is a bigger version of this. CMS wrote repeatedly that the directory data it already collects from plans for Medicare Plan Finder is meant to feed the National Provider Directory, and that the NPD may become an approved verification source once it matures. A prior essay in this newsletter went through the NPD’s April 2026 release in detail (27 million records, 71 percent of practitioners orphaned from any organization, zero percent with hours of operation), and the obvious fix for those gaps is a provider side publishing layer that writes to plans today and to NPD FHIR endpoints tomorrow. The rule just handed that layer a paying customer on both ends.

Business five: behavioral health that answers the phone

CMS made behavioral health 35 percent of the accuracy sample because the data is grim. OIG’s October 2025 report found that on average 55 percent of BH providers listed in MA and Medicaid managed care networks did not bill a single service in 2023, and when OIG surveyed a sample of those inactive providers, 72 percent said they should not have been listed at all. Ghost networks are the network. Under the new regime a plan has two choices: keep the ghosts and tank 35 percent of the grade while eating cost sharing protection claims from members who find out the hard way, or cull the ghosts and blow up network adequacy. Both are expensive. The business that resolves it is real BH supply contracted to MA at scale with verifiable availability. The Headway, Alma, Rula and Grow style aggregators did this in commercial because commercial pays; Medicare pays LCSWs, MFTs and mental health counselors 75 percent of the fee schedule, and MFTs and MHCs only became billable in 2024, so almost none of that supply has been pointed at MA. An MA focused BH network builder that delivers a roster of clinicians who actually accept the plan, actually have openings, and answer a verification email inside the 7 business day non response window CMS floated is selling a grade and an adequacy filing in the same contract. Pricing is per member per month for network access plus the verification feed. D-SNPs buy first, since their members overlap Medicaid managed care, where OIG looked too.

Business six: the ownership graph

CMS added a ninth directory element Congress did not list: common ownership or control disclosure. If a provider, group, facility or supplier is owned or controlled, in whole or in part, directly or indirectly, by the MAO, its parent, a sibling subsidiary or anything under common control with it, the directory has to say so, with model language along the lines of “This provider is under common ownership or control with” the parent. CMS was explicit that it wants researchers, SHIP counselors, brokers and policymakers to be able to measure vertical integration straight from the directory. The element is not scored yet, but it has to be populated by CY2028 and it has to be right, because the first headline about a national carrier listing a few thousand of its own clinics as unaffiliated writes itself. The business is an entity resolution and ownership graph: map every TIN, NPI, DBA and intermediate LLC to its ultimate parent, keep it current through M&A, and sell it three ways. Plans buy the compliance feed. Everyone else buys the vertical integration dataset (plan networks by percent affiliated, referral leakage, affiliate versus non affiliate reimbursement differentials). PBMs and Part D sponsors buy the mirror image, because section 6224 reaches any entity that owns, is owned by, controls or is controlled by a PBM or sponsor, plus any contractor or agent performing PBM functions, and CMS’s June RFI asked point blank whether rebate aggregators, data vendors, wholesalers, pharmacies and benefit consultants should count as affiliates. One ownership graph, two regulatory customers.

Business seven: fair market value for a PBM

Delinking turns PBM revenue in Part D into a cost plus business. The proposed rule defines fair market value for a bona fide service fee as the cost of the itemized service plus a reasonable markup, which is the single most consequential phrase in the document and will be litigated by people billing $900 an hour, which is itself a markup. Every service a PBM performs for a sponsor (claims adjudication, formulary management, rebate contracting, utilization management, network management, mail and specialty operations, reporting) now needs an itemized cost, a defensible markup, and an FMV opinion the sponsor can rely on and OIG can review, since the statute hands the Secretary and OIG the job of reviewing PBM remuneration and disgorging whatever fails. CMS’s June RFI asked how anyone determines FMV for PBM services today, whether it varies by entity type, and whether it should account for market concentration (three PBMs handle roughly 80 percent of claims) and vertical integration. The honest answer was that nobody does, because fees were never where the money was.

This creates an industry that exists for physician compensation, 340B and Stark but not for pharmacy benefits: PBM services FMV benchmarking. A firm with a defensible cost model per service, a benchmark database across PBMs and sponsors, and a markup methodology will be in every 2028 contract. Sponsors need the opinion for the annual compliance certification the statute requires them to sign. PBMs need it to keep their fees. Auditors need it to audit. The moat compounds because the July 1 reports make every PBM disclose, per plan, the total it retained including bona fide service fees, so by mid 2028 there is a semi public benchmark that a firm which started in 2027 will already have modeled. Think Milliman or ECG for PBM fees, built from scratch, with software instead of a 200 page PDF.

Business eight: the July 1 report factory

The statutory reporting package is enormous. Per plan, per year: an NDC level dispensing report with enrollee counts, pharmacy type, WAC, AWP, out of pocket spend, manufacturer rebates, DIR, average pharmacy reimbursement by channel, average NADAC, and manufacturer revenue retained by the PBM or any affiliate; an affiliate report with the share of scripts dispensed by affiliate pharmacies, combined plan and enrollee cost ranges for 30 and 90 day supplies at affiliate versus non affiliate pharmacies, affiliate acquisition cost against NADAC, and 340B drugs dispensed under PBM affiliate covered entity contracts; a brand versus generic formulary report listing every brand covered where a generic exists, with written justification and the count of equivalent generics; the same for biologics versus biosimilars; gross spend, retained amounts and net spend; benefit designs that steer members to affiliate mail, specialty or auto refill; broker and consultant compensation with the calculation methodology; the full affiliate list; and a summary document in a standard format CMS has to publish by June 1, 2027. Price guarantees now have to ship with definitions of generic, brand, specialty, rebate and discount, a list of exclusions, and a WAC equivalent for any other benchmark. Manufacturer agreements get a written explanation to the sponsor within 30 days of signing, incentive contingencies and formulary placement included, certified by the CEO, CFO or general counsel.

When the CAA 2021 created RxDC reporting for commercial plans, a dozen vendors built compliance reporting businesses in 18 months. Same movie, bigger budget. Three products fall out. A PBM side reporting engine (the big three build internally, the next 40 PBMs buy). A sponsor side intake and benchmarking layer that normalizes reports across PBMs and tells a regional MA-PD that its affiliate mail pricing runs 30 percent above NADAC against its peer group. And the audit stack, because the statute gives sponsors an annual audit right where the PBM must produce records within 6 months and answer follow ups within 30 days, with an auditor the PBM does not get to pick and affiliate data included. PBM audit firms exist for commercial; the Part D version has statutory teeth, a confidential reporting channel with anti retaliation protections, and a disgorgement destination. The customers who need all of this most are the long tail of Part D sponsors, regional Blues and provider sponsored plans that have never seen their own claims at NDC level with NADAC sitting next to them, and are about to.

Business nine: the transparent Part D PBM and the rebate desk

If PBM income in Part D is capped at cost plus markup on itemized services and 100 percent of rebates pass through, the incumbent model (keep a slice of rebates, run spread, price admin fees off WAC, route specialty to your own pharmacy, have your GPO affiliate collect a manufacturer fee) loses most of its margin stack inside Medicare. The transparent PBMs (Judi Health, the artist formerly known as Capital Rx, plus Navitus, SmithRx, Rightway, AffirmedRx and the rest) were built to charge flat PMPM admin fees and pass everything through; the statute just made their pricing the only legal pricing in a program with north of a quarter trillion dollars in gross drug cost. The open question, tbh, is whether they can actually run Part D, which is operationally brutal (LIS tiers, the redesigned benefit phases, DIR reporting, Star measures, program audits). So the business is either a Part D native pass through PBM or, more realistically for a startup, a Part D adjudication and rebate infrastructure layer that sponsors license to insource the parts they want. Several large sponsors will try contracting rebates directly with manufacturers now that the PBM has to hand over its manufacturer contract terms within 30 days anyway, and the rebate aggregator GPOs (Zinc, Ascent, Emisar) sit squarely in the affiliate crosshairs CMS asked about in June. A sponsor side rebate desk, staffed by people who used to work at those GPOs, with contract management and reconciliation software, is a real company. The constraint is manufacturer appetite to contract with 200 sponsors instead of three PBMs, which is why the desk probably launches as a service for the top 20 sponsors and productizes downward.

Business ten: pharmacy network truth

The affiliate pharmacy reports plus section 6223 (not in this rule, but same law, same clock) create a pharmacy side data product. Starting plan year 2028 CMS will publish lists of essential retail pharmacies (non affiliated, with no other retail pharmacy within 10 miles rural, 2 miles suburban or 1 mile urban, tighter than the 15, 5 and 2 mile access standards), sponsors must report affiliate pharmacy lists and pharmacy incentive payments (incentive payment reporting starts PY2027), and CMS will publish trend reports comparing essential versus non essential pharmacies on ingredient cost, fees, amounts paid, network participation, cost sharing and volume. The “reasonable and relevant” contract term standards get an RFI by April 1, 2027, standards by the first Monday of April 2028, effective PY2029, with a formal pharmacy complaint process by Jan 1, 2029 and civil money penalties available against sponsors, who in turn must have written agreements making the PBM pay them back. Independent pharmacies and PSAOs have never had this much statutory muscle, and historically they have had roughly none. The business is the pharmacy side analytics and complaint engine: benchmark every contract term and every reimbursement against NADAC and the public trend reports, determine essential retail pharmacy status by geocoding the competition, build the one allowed complaint per contract per plan year with evidence attached, and sell it through PSAOs and state associations by the pharmacy. The mirror product sells to sponsors, who now have to defend their networks and explain in a report CMS reads why affiliate mail pricing looks the way it does. The GAO study due Feb 2, 2028 is already scoped to examine price linked compensation for wholesalers, pharmacies, PSAOs and brokers, so the next round of delinking targets is named in the statute. Build for the pharmacies now and you will have the data when the wholesalers get their turn.

The zero dollar copay footnote

Section 6219 is small money and smaller paperwork, but there is a sliver of business in it. About 6 million full benefit duals at or under 100 percent FPL stop paying $1.60 and rising per generic fill in 2028, while brand copays stay at $4.90 and keep indexing. That widens the brand versus generic gap for the population with the worst adherence and the highest Star exposure for D-SNPs, and it also relieves pharmacies of the joy of collecting $1.60 on a debit card with a 30 cent interchange fee. The angle is a dual focused generic substitution and adherence program pitched to D-SNPs as a Star play: with the copay at zero the last financial excuse for a missed generic fill disappears, and the PDE data will show whether the plan did anything with that. CMS also made clear it is proposing nothing beyond the conforming change here, so anyone hoping for a broader LIS cost sharing rewrite is waiting on the Parts C and D policy rule later this fall.

What to comment on before December 15

The open questions in the rule are a map of where the business rules will land, and the comment deadline is Dec 15. On directories: minimum and maximum sample sizes (CMS proposed neither), partial credit versus binary scoring, confidence scoring across methods, fixed versus random sample dates, whether PCPs, cardiologists and oncologists join behavioral health as high inaccuracy specialties (their 45 percent plus deficiency rates already clear the threshold CMS floated), whether the NPD becomes a score eligible source, and whether CMS collects response rates by method and specialty. A verification vendor wants attestation ecosystems and the NPD recognized and wants a minimum response rate, because minimums create demand. On PBMs: the affiliate definition (are GPOs, data vendors, consultants and wholesalers in), what reasonable markup means in actual numbers, what counts as an itemized service, which incentive fees survive, and what the standard report formats look like. A sponsor wants everything in; a transparent PBM wants a tight itemized service list so incumbents cannot relabel spread as network management. Builders rarely comment on rules and should, because the letters that name specific verification methods and data elements are the ones CMS cites when it writes the technical guidance, and the guidance is where the product requirements actually live.

Closing

The pattern across all three sections is the one that has powered health tech for twenty years: Congress makes a number public. In 2012 it was Medicare claims, in 2016 hospital star ratings, in 2021 hospital price files. This time the number is a letter grade on Plan Finder, a fee on an itemized invoice, and a NADAC comparison in a report CMS can read, and every time that happens a business gets built on the gap between what the regulated entity knows about itself and what it now has to prove. This one comes with a calendar: contracts rewritten by spring 2027, verification live by Q4 2027, first grades and first PBM reports in 2028, grades public in 2029. The rule runs 265 pages and a good chunk of them are CMS asking for help. Take the hint

.

Part D bids for 2028 are due June 2027. Every pharmacy benefit manager contract built on spread, rebate retention, or volume-based fees has to be rebuilt before those bids go in. The real deadline is spring 2027.

On the directory side: CMS reviewed 142 Medicare Advantage organizations from 2022 to 2024 and found 44% of location listings had at least one deficiency. That number is basically a preview of the letter grade every plan will receive starting in 2029.

CMS admits in its own impact table that it cannot estimate the financial effect of the pharmacy benefit manager provisions. Reason: nobody outside the pharmacy benefit managers knows what the current contracts say. That sentence is the whole reason the law exists.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

Part D bids for 2028 are due June 2027. Every pharmacy benefit manager contract built on spread, rebate retention, or volume-based fees has to be rebuilt before those bids go in. The real deadline is spring 2027.

On the directory side: CMS reviewed 142 Medicare Advantage organizations from 2022 to 2024 and found 44% of location listings had at least one deficiency. That number is basically a preview of the letter grade every plan will receive starting in 2029.

CMS admits in its own impact table that it cannot estimate the financial effect of the pharmacy benefit manager provisions. Reason: nobody outside the pharmacy benefit managers knows what the current contracts say. That sentence is the whole reason the law exists.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today’s video teaser, see the podcast and article link in the comments.

🎧 Part I Podcast free on Apple Podcasts and Spotify.

Trey’s Thoughts on Healthcare Markets & Technology

Part I: A Business Plan for Buying a Veteran-Owned Federal Healthcare Services Contractor at $2M to $3M of EBITDA and Growing It Into the $50B Rural Health Transformation Program Before It Sunsets

Veteran-owned federal healthcare contractors trade at 4-6x earnings. Similar firms without the certification trade at 9-11x. That gap exists because the buyer pool is legally restricted to service-disabled veterans with capital…

Listen now

4 days ago

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Trey’s Thoughts on Healthcare Markets & Technology

Part II: A Business Plan for Buying a Veteran-Owned Federal Healthcare Services Contractor at $2M to $3M of EBITDA and Growing It Into the $50B Rural Health Transformation Program Before It Sunsets

Veteran-owned federal healthcare contractors trade at 4-6x earnings. Similar firms without the certification trade at 9-11x. That gap exists because the buyer pool is legally restricted to service-disabled veterans with capital…

Listen now

4 days ago

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. Why this deal and why now

2. What the target actually looks like

3. The certification trap

4. Price, structure and a capital stack the SBA will tolerate

5. Fifty billion dollars of plumbing

6. What states bought in year one and what they are buying in year two

7. Five service lines, ranked by how fast they pay

8. The first hundred days and the three years after

9. A base case without heroics and a downside case without tears

10. Risks, including the one where it all ends in 2030

11. Exit

Abstract

The pitch is an arbitrage with a clinical license. Small service-disabled veteran-owned healthcare contractors trade cheaply because the only buyers who can keep the certification alive are other service-disabled veterans, which shrinks the buyer pool and spooks private equity. At the same time, the Rural Health Transformation Program is pushing $10 billion a year through 50 state agencies from fiscal 2026 through fiscal 2030, and year one taught every state the same lesson: writing a transformation plan is easy and delivering one with a health department staff of 40 is not. Year two procurement, beginning October 31, is mostly implementation, technical assistance, workforce, program management, evaluation and technology deployment. That is services work, and a company that already staffs rural VA clinics and supports community care providers is the connective tissue the states lack. The plan: a service-disabled veteran operator buys a $15M to $30M revenue, $2M to $3M EBITDA federal healthcare services firm at roughly five times, keeps the certification intact through a stock purchase and a 30-day recertification, and bolts on a state-facing capture engine aimed at RHTP contracts in the dozen states where the company already has a VA footprint. Base case takes EBITDA from $2.5M to roughly $5.5M by 2029, with the RHTP piece deliberately migrated toward recurring state and Medicaid work before the federal spigot closes. Downside case still services the debt. The biggest risks are the sunset itself, a recertification stumble, VA concentration, and the compliance rules that make it very easy to accidentally bill a state for something an insurer was supposed to pay for.

Why this deal and why now

Somewhere in an office park a few exits from a VA medical center sits a 61-year-old retired Army nurse who owns a $22 million staffing and care coordination company, has three VA task orders rolling into recompete over the next 30 months, no succession plan, and a business broker telling her she is worth eight times EBITDA because “government services are hot.” She is worth about five. The gap between those two numbers, and what you do with the company after you close it, is this business plan.

The thesis has two halves that happen to fit. The first half is structural mispricing. A certified service-disabled veteran-owned small business, SDVOSB in the trade, carries its contracting preference in the owner’s DD-214 and disability rating, not in the company. Sell it to a non-veteran and the set-aside eligibility evaporates like a free trial. That means the natural acquirers, the lower-middle-market PE shops and the roll-up platforms that pay nine to eleven times for mixed-agency government services, mostly cannot touch these companies without destroying the thing that generates the revenue. The buyer pool collapses to service-disabled veterans with capital, which is a small club. Small clubs pay less.

The second half is the money. Public Law 119-21, the July 2025 reconciliation law that goes by at least three names depending on who is talking, created a $50 billion Rural Health Transformation Program administered by CMS. Ten billion a year, five years, all 50 states funded, with CMS required to approve or deny applications by December 31, 2025. The first budget period closed October 30, 2026, and the second budget period began October 31. Year-one awards were made to all 50 states, with individual awards varying materially by state: Texas received $281,319,360.67, while Delaware received $157,394,963.86 and Michigan received $173,128,201.

And here is the bridge. Roughly 4.4 million veterans live in rural America, about 2.7 million of them enrolled in VA care, and close to 40 percent of VA care now gets delivered by non-VA providers through community care. Those community providers are the same critical access hospitals, rural health clinics and FQHCs that states are now trying to shovel RHTP money into. A company that already credentials clinicians for rural VA community clinics and knows how to invoice the federal government without triggering an audit finding is already standing in the right county. It just has never sold to a state.

What the target actually looks like

The profile is narrower than “veteran-owned healthcare contractor” sounds. You want revenue between $15 million and $30 million, EBITDA of $2 million to $3 million, and margins in the 8 to 15 percent range, which tells you the mix is mostly clinical staffing with some higher-margin professional services on top. Typical lines: nurses, mental health providers and telehealth clinicians placed at VA medical centers and community-based outpatient clinics; care coordination and case management; health information management, coding and release of information; suicide prevention and outreach programs; and subcontract work under the community care network administrators, which today means Optum Serve and TriWest. Some of these firms also carry Defense Health Agency or Indian Health Service work, which is a plus for diversification and a minus for complexity.

Contract vehicles matter more than the logo. VA set-aside task orders under agency IDIQs, sole-source awards (VA can sole-source to a certified SDVOSB up to $5 million for services, which is both a gift and a fragility), and subcontracts to the big network administrators. Revenue concentration at VA of 70 to 90 percent is normal and should be priced, not avoided. What should scare you is a recompete calendar that stacks in the first 12 months after close, or professional services revenue that looks like “executive support and training,” because that is exactly the category that got hit in February and March 2025 when VA canceled 585 non-mission-critical or duplicative contracts after reviewing nearly 2,000 professional-services contracts. Pull the termination lists and check every contract number before you fall in love.

Other diligence that separates a real target from a broker’s deck: CPARS ratings on every order, Service Contract Act compliance including wage determinations and the health and welfare benefit, a timekeeping system that would survive a DCAA floor check, documented indirect rates, clinician turnover and credentialing files, and the receipts-based size standard math. Staffing under NAICS 561320 caps at $34 million in five-year average receipts; physician office codes sit near $16 million; outpatient and miscellaneous practitioner codes are lower still. A $28 million staffing business growing 12 percent a year is two years from ceasing to be small, and when it stops being small, the set-aside work stops too. Finally, find out whether the owner is the entire business development function. Usually yes. Price that in, and plan to keep her on a consulting agreement for a year, subject to counsel’s review of applicable SBA eligibility and control rules.

The certification trap

Everything about the certification rewards reading the regulation and punishes reading the summary. Since January 1, 2023, SBA runs the program through VetCert under 13 CFR Part 128, the VA Center for Verification and Evaluation is gone, and the Dynamic Small Business Search is the system of record contracting officers actually check. To qualify as an SDVOSB, service-disabled veterans must unconditionally and directly own at least 51 percent of the company, 51 percent of each class of voting stock and 51 percent of the aggregate, and must control it. Control is where deals die. The qualifying veteran has to hold the highest officer position, manage the business day to day and set its long-term direction, work at it full time during normal working hours, and be the highest-compensated person in the company unless there is a documented reason otherwise. The non-veteran COO has to earn less than the veteran CEO, which may be the only federal rule that founders enforce with genuine enthusiasm.

Negative control kills it just as dead as ownership does. Supermajority voting requirements, veto rights held by non-veteran investors, the ability to block a quorum, buy-back provisions, put or call options that could move ownership away from the veteran, all of it is disqualifying. Operating agreements drafted by generalist deal lawyers routinely contain three or four of these as boilerplate investor protections. Have government contracts counsel draft the operating agreement first and the purchase agreement second, run SBA’s eligibility checker on the structure before signing an LOI, and accept that the investors in this deal are going to be more passive than they are used to.

Then the clock. When ownership changes through a sale, merger or acquisition, the company must recertify within 30 days of the transaction. If the buyer qualifies, the company keeps competing for set-asides. If the buyer does not, the status is gone, existing contracts generally keep running but no new set-aside awards or recompetes, and any contracting officer exercising an option gets to check DSBS first. The 30-day recertification is the one deadline in government contracting nobody lets slip. Buy the stock or membership interests, not the assets, so the contracts stay with the same legal entity and you avoid novation under FAR Subpart 42.12, a process that takes months and that the contracting officer can simply decline. The cost of a stock deal is that you inherit the company’s history, including whatever it certified on every prior award, so budget for False Claims Act diligence on past size and status representations and hold back 10 percent in escrow. Do not even think about the structure where a veteran holds 51 percent on paper while someone else runs the company. The Justice Department has a name for that and it is not “creative.”

One more wrinkle for anyone planning to grow through joint ventures: under the Vets First program, a joint venture must be SDVOSB-eligible at the time of award, and VA rules can be stricter than SBA’s. Teaming for state work does not run through those rules at all, which is one of the quiet advantages of the plan below.

Price, structure and a capital stack the SBA will tolerate

Start with the market and then discount it. Publicly traded government services companies saw enterprise value to EBITDA compress from about 15.4 times at the end of 2023 to roughly 11.5 times by the end of 2025 while defense tech ran off in the other direction. In the private lower middle market, brokers quote government services at anywhere from 6 to 14 times depending on clearances, agency mix and whether the firm is a prime on a vehicle. None of those tiers describe this target. Unclassified, single-agency, set-aside-dependent, sub-$3 million EBITDA, with a buyer pool limited to people who can produce a VA disability rating letter: that is a four to six times business, and five is a fair opening number for a clean one. Pay six only for backlog that covers two full years and a recompete calendar that is empty for 18 months.

Illustrative deal on $2.5 million of EBITDA at five times, $12.5 million enterprise value. SBA 7(a) caps at $5 million per borrower, so this cannot be a pure SBA deal, and the cleanest stack is a conventional senior term loan from a bank that understands government receivables, about $6 million or 2.4 times EBITDA; a seller note of $2.5 million at 6 percent, on full standby for 24 months, with a $750,000 reduction if SBA denies recertification or if a named VA contract fails to have its option exercised within 12 months of close; and $4 million of equity. The equity is the part that takes a lawyer. The veteran CEO owns 51 percent of the common. Outside investors own the other 49 percent and put the balance of their money in as subordinated notes with a modest PIK coupon and no governance rights beyond information and a customary consent on selling the company, which counsel will tell you is right at the edge of what SBA considers acceptable, so get it pre-reviewed. Fixed charges on that structure run about $1.5 million a year, which against $2.5 million of EBITDA, less modest capex and distributions for taxes, gives the senior lender the 1.25 times coverage it will insist on and leaves a cushion for the recompete you are going to lose anyway.

Two operating notes on cash. VA pays through Treasury on a net-30 cadence that is close to reliable; states pay in 45 to 90 days and some of them pay in installments tied to deliverables, so the growth plan needs a $2 million revolver sized to state receivables, and the bank will want it carved out from the term loan collateral. And if the buyer is a veteran, ask the SBA lender about fee relief on the guaranteed portion; the programs change annually and the savings are real but not deal-changing.

Fifty billion dollars of plumbing

Section 71401 of the law appropriates $10 billion for each of fiscal years 2026 through 2030 and hands it to CMS to distribute by cooperative agreement to states, and only to states. No hospital, clinic or vendor applies to CMS for anything. Half of each year’s money, $5 billion, is split equally, so every state gets $100 million a year for showing up. The other half is distributed through the program’s workload and application criteria. First-year awards were released for all 50 states by December 31, 2025, and subsequent state announcements show that awards vary substantially: Texas received $281.3 million, Delaware $157.4 million and Michigan $173.1 million for the first budget period. The state plans, rather than a direct CMS vendor grant program, are the commercial opportunity.

The spending rules are where a vendor either builds a durable business or an audit finding. States had to pick allowable categories covering areas such as prevention and chronic disease, workforce, training and technical assistance, technology-enabled care, health IT and cybersecurity, behavioral health, rural delivery redesign, and capital. Administrative costs, including every subrecipient’s admin, are capped at 10 percent of the award. Capital and infrastructure cannot exceed 20 percent and cannot include new construction; think equipment and minor renovation. Payments to providers under the applicable provider category are capped at 15 percent. RHTP money cannot pay for clinical services that an insurer would reimburse, and it cannot supplant spending that was already planned or funded from somewhere else. All of it lives under 2 CFR Part 200, which brings federal grant-management and audit obligations. Each year’s money must be spent by the end of the following fiscal year, with the program’s funding period ending in fiscal 2030 and final expenditures governed by the program terms.

The single most useful distinction for the acquired company is subrecipient versus contractor. A subrecipient carries out part of the program, takes on flow-down obligations, and gets audited like a grantee. A contractor sells goods or services to the state at a price. Be the contractor wherever possible. It means state procurement rules instead of grant rules, it means SAM.gov registration is irrelevant and state vendor portals are very relevant, and it means the SDVOSB status that made the company cheap to buy is mostly beside the point in winning the work, which is exactly the hedge you want.

What states bought in year one and what they are buying in year two

Year one was uneven and that unevenness is the opportunity. The first budget period ran from December 31, 2025, through October 30, 2026, and the second began October 31. States are now moving from approved plans to implementation awards. Texas announced $78,089,434.73 in Rural Texas Strong grants to 216 rural healthcare providers on October 16, a portion of its $281,319,360.67 first-year award. Nebraska also announced more than $177 million in RHTP funding on October 13. Delaware announced a $157.4 million first-budget-period award, while Maryland announced $16.4 million in workforce awards from its $168.2 million first-budget-period allocation. The number of state documents that contain the word “hub” would make a bicycle shop blush.

The pattern across all of it: nonprofits, hospitals and health centers win the subawards for care delivery, and commercial firms win as the implementation partner, the technical assistance contractor, the evaluator, the fiscal administrator and the technology deployer underneath them. That is the lane. CMS and states are now publicizing concrete workforce, mobile-care, technology and provider-award initiatives, and reading them as a sales document rather than a policy document is the whole trick.

Five service lines, ranked by how fast they pay

First and fastest is workforce. Training and technical assistance is an explicit allowable use, workforce development is a scoring factor, and a staffing company’s core competency is finding, credentialing and deploying clinicians into places nobody wants to live. The trap is supplanting: a state cannot use RHTP money to pay a nurse’s salary at a critical access hospital that was going to employ a nurse anyway, and it cannot pay for billable visits. What it can pay for is recruitment programs, preceptor and residency rotations, community health worker and health aide training, retention stipends, and the design of a regional float pool that a hospital network then funds from operations. Sell the program, not the body.

Second is program management and fiscal administration. Every state has a 10 percent admin cap and a transformation plan with eight to fifteen initiatives, so the management work gets bought as program delivery under the initiative categories rather than as admin. New York’s third-party administrator model and South Dakota’s consulting hires are the template. A federal contractor’s boring assets, DCAA-grade timekeeping, documented indirect rates, a compliance person who has read 2 CFR 200 twice, are exactly what a state health department terrified of a single audit finding wants to see on page one of a proposal.

Third is evaluation and data. CMS’s state-based funding model and reporting requirements give states a direct financial incentive to measure well and report on time. Partner with a university center for the methods credibility and do the data engineering and reporting operations yourself.

Fourth is technology deployment, specifically the last mile. Telehealth, remote monitoring, EHR and HIE integration, and cybersecurity are allowable and heavily funded, but the software vendors who win those categories have no one to put in a 25-bed hospital in a county with one stoplight to make the thing actually work. Be the implementation and change-management layer. For cyber, get on the state-level managed security provider lists the way Texas requires, and remember that state and local buyers can purchase IT and security services off the GSA schedule through cooperative purchasing if the company already holds one.

Fifth, and slowest, is standing up care models: hub-and-spoke networks, mobile units, behavioral health integration, critical access to rural emergency hospital conversions. These are the big-dollar subawards, they go to anchor providers, and the right move is to be named in the anchor’s application as the delivery partner before the application is written. That requires relationships that take a year to build, which is why the capture team gets hired in the first hundred days and not the first year.

The first hundred days and the three years after

Days zero through thirty are entirely defensive. File the recertification. Notify every contracting officer of the change of ownership in writing, because surprises at option time are how a stock deal turns into a novation anyway. Sit with every clinician on a VA site and explain that nothing about their paycheck changed. Confirm the senior lender’s reporting package and get the first covenant test out of the way.

Days thirty through one hundred are hiring and registration. The capture team is three people: a former state Medicaid or health department official who knows which deputy commissioner actually decides, a proposal lead who has written state responses rather than federal ones (different animals, state evaluators read for compliance with the RFP outline and penalize creativity), and a grants compliance lead with 2 CFR 200 scars. Register in the vendor portals of the ten to twelve states where the company already has VA clinics or community care subcontracts, sign teaming agreements with two university evaluation centers and three or four nonprofit anchors, and submit the first five bids before the hundred days are up, knowing most will lose. The point of the first bids is to be on evaluators’ radar when year three RFPs drop.

Year one, calendar 2027, is volume: roughly 20 state submissions at a fully loaded cost of $40,000 to $80,000 each, a 20 to 30 percent win rate for a firm with real past performance, four to six awards. Year two is depth: expand inside the states that awarded something, add the evaluation line, and start converting one-time implementation contracts into multi-year TA agreements structured like Montana’s, which runs through 2030. Year three, 2029, is the pivot that determines exit value: push the state relationships toward money that outlives RHTP, Medicaid 1115 waiver implementation, HRSA-funded state office of rural health programs, Flex program work for critical access hospitals, and commercial contracts with the regional networks that the RHTP hubs turn into once the federal money stops.

A base case without heroics and a downside case without tears

Entry: $20 million of revenue, $2.5 million of EBITDA. Base case assumes the VA book grows 4 percent a year and loses one recompete in year two, roughly offsetting. RHTP-funded state revenue comes in at $3.5 million in 2027, $8 million in 2028 and $12 million in 2029, at 18 to 22 percent contribution margins because technical assistance, program management and evaluation price like consulting rather than like staffing. Capture and compliance overhead adds about $900,000 a year by 2028. Consolidated EBITDA lands around $3.2 million in 2027, $4.5 million in 2028 and $5.6 million in 2029. Senior debt amortizes to roughly $3 million by the end of 2029 and the seller note is paid.

Now the honest part, which is how a buyer in 2029 will value those earnings. Nobody pays seven times for EBITDA attached to a program with a statutory end date. Model the exit as a sum of parts: the federal and recurring state base, call it $3.4 million of EBITDA, at seven times because by then it is multi-agency and multi-state; and the RHTP-specific piece, about $2.2 million, at three times because the acquirer assumes it decays. That is roughly $30 million of enterprise value, about $27 million of equity after net debt, against $4 million of equity in. If the year-three pivot works and half the RHTP revenue has converted to Medicaid or commercial contracts, the blended multiple moves up a turn and the number gets closer to $35 million. Either outcome is a very good five years for a nurse who was told she was worth eight times.

Downside case: recertification hits a snag and takes 90 days instead of 30, one VA option does not get exercised, and the state capture engine wins at half the base case rate. EBITDA in 2029 is about $3.5 million. Fixed charges are still covered at better than 1.4 times, the seller note price adjustment absorbs part of the pain, and an exit at five times still returns the equity roughly three and a half times. The scenario that actually loses money is a buyer who pays seven times at entry, borrows against it, and then discovers that the whole plan hinged on a certification that did not survive the operating agreement.

Risks, including the one where it all ends in 2030

The sunset is the risk that should be on the first slide. Fiscal 2030 is the last appropriation, states spend it through fiscal 2031, and CMS wants every dollar gone by the end of fiscal 2032. A business that is 60 percent RHTP revenue in 2030 is a business with a going-out-of-business sale built in. The entire operating plan is shaped around that, and the discipline is to refuse growth that makes the mix worse after 2028 no matter how easy the money looks. Adjacent to the sunset is rescission risk: unobligated mandatory balances are exactly what future reconciliation bills go looking for, and states that are slow to obligate are the ones most exposed. Prioritize states that moved in year one.

State execution risk is real and uneven. Some states will procure through 12-month cycles with protests, some will route money through a handful of anchor hubs that behave like monopsonies, and a few will spend the fourth quarter of every budget period in a panic because the obligation deadline is the only one that counts. The 15 percent provider payment cap and the supplanting prohibition make it genuinely easy to design a staffing-flavored proposal that an auditor later reclassifies as paying for reimbursable care; the compliance lead earns her salary by killing those proposals before they are submitted.

On the federal side, the recertification is the acute risk and VA concentration is the chronic one. February 2025 proved that a professional services contract at VA can be terminated for convenience on a Tuesday by someone who read a one-sentence justification, and the community care contracts are being re-let in a two-region structure that could reshuffle the subcontract tiers underneath them. Size standard creep is slower but just as fatal to the set-aside base, and the fix is growing the non-set-aside revenue, which the plan does anyway. Working capital from state receivables, clinician retention at rural sites that are hard to staff on a good day, and the key-person problem of a CEO who has to be a full-time service-disabled veteran with no ready substitute round out the list. Buy key-person coverage, and have a succession conversation with a second veteran executive in year one, not year four.

Exit

The exit is designed into the mix shift. At entry, the company’s value lives inside a certification that only a service-disabled veteran buyer can preserve, which is why it was cheap. By 2029, if the plan has worked, more than half of revenue comes from state, Medicaid and commercial contracts that do not care who owns the company, and the buyer universe opens up to the same PE platforms and strategic acquirers that could not bid in 2026. They will pay a full multiple for the state relationships and a haircut for the VA set-aside base, which is fine, because the set-aside base was bought at a haircut too. The alternative exit is to sell to another service-disabled veteran operator, probably with SBA financing, at a multiple closer to entry but on EBITDA that has doubled. And there is a third path that nobody writes business plans about: keep it. A diversified rural health services company doing $45 million with real margins, a federal book, and a Rolodex of state deputy commissioners is a nice thing to own in a decade when rural health finance is going to keep getting rewritten every couple of years, by whichever party is holding the pen

.

Sell a certified service-disabled veteran-owned small business to a non-veteran and the contracting preference disappears. The certification lives in the owner’s discharge papers, not in the company. So private equity mostly cannot play.

Meanwhile a fifty-billion-dollar Rural Health Transformation Program is moving ten billion a year through all fifty states from 2026 through 2030. Year one was planning. Year two is implementation, workforce, program management, and tech deployment.

A company already staffing rural VA clinics and credentialing community care providers is operating in the same counties, the same hospitals, the same federally qualified health centers that states are now trying to transform. It just has never sold to a state health department.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

Sell a certified service-disabled veteran-owned small business to a non-veteran and the contracting preference disappears. The certification lives in the owner’s discharge papers, not in the company. So private equity mostly cannot play.

Meanwhile a fifty-billion-dollar Rural Health Transformation Program is moving ten billion a year through all fifty states from 2026 through 2030. Year one was planning. Year two is implementation, workforce, program management, and tech deployment.

A company already staffing rural VA clinics and credentialing community care providers is operating in the same counties, the same hospitals, the same federally qualified health centers that states are now trying to transform. It just has never sold to a state health department.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.