Where the 17 actually comes from

The executive order and the pressure step

Pfizer through AstraZeneca and the deal template

The Lilly and Novo GLP-1 deal as the actual main event

The December nine and the J and J pickup

TrumpRx and what is actually live on the page

Regeneron and the closing of the cohort

What is in the deals and what is conspicuously missing

IRA plus MFN as a quasi-voluntary hybrid

The new adjudication layer and where the infrastructure gets built

Open questions, gaps, and what to watch next

Abstract

The viral “17 pharma companies” claim circulating off the recent White House posts is real, but the actual evidence base is fragmented. There is no consolidated White House list. The cohort has to be reconstructed from three layers: the July 2025 demand letters, the rolling deal announcements from Sept 2025 through April 2026, and reporting filling in the gaps. Cohort: AbbVie, Amgen, AstraZeneca, Boehringer Ingelheim, BMS, Lilly, EMD Serono, Genentech, Gilead, GSK, J&J, Merck, Novartis, Novo, Pfizer, Regeneron, Sanofi. Roughly 86% of branded drug market by the admin’s own framing. Key pricing data points: GLP-1s at ~$245 Medicare/Medicaid, ~$350 TrumpRx cash, $50 Medicare copay; Praluent cut from $537 to $225; Otarmeni free in the US. Important caveats: deals are bilateral and confidential; no published contract text, no reference country basket, no MFN formula, no state Medicaid implementation guidance, no drug-by-drug schedule. The actual investment angle is the new adjudication layer this creates: MFN benchmarking engines, compliance tooling, Medicaid plus DTC routing, employer fiduciary analytics, and drug-level channel arbitrage. None of that infrastructure exists at production scale today.

Where the 17 actually comes from

The first thing to flag is that the canonical list of 17 does not live in any single White House document. There is no master PDF, no consolidated dataset, no clean spreadsheet sitting on whitehouse dot gov with seventeen rows. Anybody trying to chase down the actual cohort has to reconstruct it from three different layers stacked on top of each other. Layer one is the original demand letter cohort from July 2025. Layer two is the rolling sequence of deal announcements that came out from September 2025 through April 2026. Layer three is third-party reporting filling in the gaps where the administration did not bother to publish anything formal.

The seventeen companies, once stitched together from those three layers, are AbbVie, Amgen, AstraZeneca, Boehringer Ingelheim, Bristol Myers Squibb, Eli Lilly, EMD Serono (which is the US arm of Merck KGaA, not the US Merck, and yes the naming convention is annoying), Genentech (the Roche subsidiary), Gilead Sciences, GSK, Johnson and Johnson, the US Merck, Novartis, Novo Nordisk, Pfizer, Regeneron, and Sanofi. That collection represents around eighty-six percent of the branded drug market by the administration’s own framing in the final Regeneron fact sheet. Everything that gets discussed under the MFN umbrella traces back to that group. Anyone trying to reason about which manufacturers are exposed, which therapy classes get hit first, or which channels are most likely to see margin compression needs to start with the seventeen-company anchor.

The reason this matters is not academic. The deal-by-deal language varies a lot, the therapeutic categories vary a lot, and the publicly disclosed pricing methodology varies even more. But the cohort itself is the constraint, and any analytical work on this program that does not sit on top of that cohort is going to be either too narrow or too broad to be useful.

The executive order and the pressure step

The legal scaffolding starts with the May 12, 2025 executive order on most-favored-nation prescription drug pricing. That order does three things that matter. It directs HHS to set MFN targets across products and channels. It enables direct-to-consumer sales structures designed to bypass the traditional PBM-intermediated path. And it threatens rulemaking if voluntary progress from manufacturers fails to materialize. That last piece is the actual lever. Voluntary programs in healthcare almost never work on their own merits, but they work fine when the alternative is a slower and more painful regulatory process the manufacturer cannot easily fight in court.

Two and a half months later, on July 31, 2025, the White House put out a fact sheet saying that manufacturer proposals had fallen short and that letters had been sent to the leading manufacturers spelling out what they needed to do. That is the moment the seventeen-company cohort becomes a real thing rather than a rhetorical target. The pressure structure is straightforward. The administration has tariff authority, executive order authority, and rulemaking authority. The threat package is broad enough that the rational play for a multinational pharma company is to come to the table and shape the deal rather than litigate it.

The other detail worth flagging from the July step is the framing around foreign revenue repatriation and US manufacturing investment. The deals are not just about Medicaid pricing. They are bundled with implicit and explicit commitments around onshoring production capacity, exempting certain pharmaceutical inputs from tariffs, and making sure the US-priced channels do not subsidize cheaper international markets indefinitely. That bundling is what makes the program politically durable, because it ties drug pricing into the broader trade and industrial policy stack rather than letting it sit as a one-off pricing reform that a future administration can easily unwind.

Pfizer through AstraZeneca and the deal template

The first actual deal landed with Pfizer on September 30, 2025. That fact sheet is the single most important primary source for anybody trying to understand what these MFN agreements actually contain, because every subsequent deal is roughly a variation on the Pfizer template. The Pfizer agreement covered four buckets. First, Medicaid gets MFN access on Pfizer’s portfolio. Second, all of Pfizer’s new innovative medicines get MFN pricing at launch. Third, Pfizer commits to a foreign revenue repatriation structure. Fourth, Pfizer offers DTC discounts through what would later become the TrumpRx platform. The fact sheet specifically named Eucrisa, Xeljanz, and Zavzpret as included products, which gives a useful read on how the administration was thinking about scope. It was not just specialty drugs and not just primary care. It was a mix of inflammatory, eczema, and migraine products, which suggests the channel logic was driven more by what Pfizer wanted to put on the table than by any clean therapeutic category.

The AstraZeneca deal followed in October 2025 as the second MFN agreement. That fact sheet did three useful things. It confirmed that the July letters had gone to the leading manufacturers, which is one of the few places the administration explicitly tied the September deal to the July pressure step. It validated that the Pfizer template was going to be the running pattern. And it provided the first signal that the deals were going to be cumulative rather than one-off, with each new agreement adding to the same MFN framework rather than spinning up a new structure.

That second deal is also where the bilateral and confidential nature of the agreements starts to become a real analytical problem. The fact sheets describe what is in each deal at a high level, but there is no published contract text, no reference country basket, no MFN calculation methodology, and no drug-by-drug pricing schedule. That gap stays open through every subsequent deal and is one of the central things AMCP flagged in its later analysis.

The Lilly and Novo GLP-1 deal as the actual main event

The November 2025 announcement covering Eli Lilly and Novo Nordisk is the commercial center of gravity for the entire program, even though structurally it is just one of the seventeen tranches. The reason is obvious to anybody who has been watching GLP-1 economics for the last three years. The GLP-1 class is the biggest pricing and volume story in pharma in a decade, with Ozempic and Wegovy from Novo and Mounjaro and Zepbound from Lilly running combined US revenue numbers that rival some entire therapeutic categories. Anything that touches that pricing structure has implications that ripple through PBM economics, employer plan design, formulary positioning, supplemental rebate dynamics, and the broader specialty pharmacy infrastructure.

The named products in the Lilly-Novo deal include Ozempic, Wegovy, Mounjaro, Zepbound, future oral GLP-1 formulations, Emgality, Trulicity, NovoLog, and Tresiba. The pricing structure is where it gets interesting. Medicare and Medicaid prices for some GLP-1s land at $245 per month. TrumpRx cash prices for the same products run around $350. Medicare beneficiary copay caps at $50. Those numbers are not random. The $245 figure is roughly aligned with what other developed-market public payers pay for GLP-1s under their own price negotiation regimes. The $350 figure is a discount off list but still leaves meaningful margin in the cash channel. The $50 copay is the politically visible number that drives the press coverage and the patient-facing experience.

The implication for PBM economics is the part that does not get enough airtime in the consumer-facing coverage. If the public payer net price for GLP-1s is $245, the rebate spread that PBMs have been earning on those products gets compressed in a way that has knock-on effects across formulary positioning, exclusivity arrangements, and net cost calculations on the commercial side. Employer fiduciary obligations under ERISA become a much more uncomfortable place to sit when the public benchmark price is suddenly visible and lower than what the plan is paying. That sets up a litigation risk that is independent of the MFN program itself but accelerated by it.

The other thing worth flagging is the inclusion of future oral GLP-1s in the deal. That is not a small detail. The oral GLP-1 pipeline is where the next phase of the obesity and diabetes market gets fought, and locking in MFN pricing at launch for those products eliminates the standard playbook of high launch pricing followed by gradual rebate-driven net price compression. It changes the whole launch economics calculus for any oral GLP-1 entrant going forward, including the smaller biotechs that were planning to ride the slipstream of the Lilly and Novo branded launches.

The December nine and the J and J pickup

The December 2025 fact sheet was the largest single batch announcement of the program, covering nine companies in one tranche. Those nine were Amgen, Bristol Myers Squibb, Boehringer Ingelheim, Genentech, Gilead, GSK, Merck, Novartis, and Sanofi. The deal structure was the running Pfizer template: Medicaid MFN access on the existing portfolio, MFN at launch on new innovative medicines, and DTC discount routing through TrumpRx. The administration framed this as the largest set of developments to date in bringing MFN pricing to American patients, which was accurate in terms of company count but somewhat misleading in terms of underlying drug coverage, because the per-deal coverage varies and the public-facing fact sheets do not break it out at the SKU level.

Johnson and Johnson came in shortly after the December tranche, bringing the total to fifteen of the seventeen, as covered in AJMC’s reporting on the J and J agreement. That left AbbVie and Regeneron as the two final holdouts, which is a meaningful fact in itself. AbbVie’s exposure across Humira biosimilar dynamics, Skyrizi, Rinvoq, and the broader immunology portfolio made any MFN structure non-trivial to negotiate, and Regeneron’s positioning around Eylea and Praluent created its own set of pricing pressure points. The fact that those two companies held out longer than the others was a signal about deal complexity, not about whether they were going to come in at all.

Throughout this period the public-facing data on what each deal actually covered remained thin. The fact sheets named specific products in some cases, the TrumpRx browse page added drugs as deals were signed, and third-party reporting filled in the gaps inconsistently. There was no centralized place to see, for example, that BMS had committed to MFN pricing on a specific subset of its oncology portfolio with a specific rebate methodology against a specific reference country basket. Those details either did not exist in published form or were embedded in the bilateral contracts that the administration has not released.

TrumpRx and what is actually live on the page

TrumpRx is the consumer-facing piece of the program and the only place where the abstract pricing commitments turn into actual numbers a patient or an analyst can see and copy down. The browse page lists eighty drugs as of the most recent check, which is a useful artifact because it is the closest thing to a live view of what the manufacturers have actually agreed to put into the DTC channel. The drugs listed include Combigan, Toujeo, Mayzent, Cetrotide, Xigduo XR, Farxiga, Zeposia, Sotyktu, Humira, Wegovy, Ozempic, and a long tail of others spanning ophthalmology, endocrinology, neurology, immunology, fertility, and metabolic disease.

The platform itself is primitive. The browse experience is a flat list with cash prices and not much else. There is no integration with patient assistance programs, no real coordination with state Medicaid systems, no plan-level routing, and no clear handoff into the broader pharmacy benefit infrastructure. That primitiveness is both a feature and a liability. As a feature, it means TrumpRx can be stood up quickly and updated as deals close, which is what the administration needed politically. As a liability, it means the platform does not scale to the actual workflow that patients, prescribers, pharmacies, and payers need to make these prices usable in real life.

The bigger point is that TrumpRx as currently built is a placeholder. Somebody is going to build the real version. The real version needs eligibility verification, prescriber workflow integration, mail-order and specialty pharmacy fulfillment, real-time benefit comparison against existing plan coverage, secondary payer coordination for the Medicare and Medicaid populations, and audit-grade pricing transparency that can be used in fiduciary disputes. None of that exists today on TrumpRx, and none of it is in any of the public deal documents. That gap is where a meaningful chunk of the entrepreneurial opportunity sits, regardless of who ends up building it.

Regeneron and the closing of the cohort

The Regeneron deal closed the cohort on April 23, 2026, and the corresponding White House fact sheet from April 2026 is the document behind the screenshot that started a lot of the social media discussion. That fact sheet explicitly frames Regeneron as the seventeenth MFN deal and states that the seventeen leading pharmaceutical manufacturers represent eighty-six percent of the branded drug market. The named products and pricing details in the Regeneron deal are useful as a closing data point. Praluent, the PCSK9 inhibitor, gets cut from $537 to $225 through TrumpRx. All of Regeneron’s new medicines going forward get MFN pricing at launch. And Otarmeni, which is a smaller-volume product with a specific patient population, is provided free to US patients.

Reuters and STAT both reported on the Regeneron deal in April, with the STAT piece going into the most detail on the negotiation dynamics. The reporting confirms that Regeneron held out longer than most of the cohort because of the specific pricing pressure points around Eylea and the broader retinal disease portfolio. The deal as signed appears to have addressed the Praluent and Otarmeni pieces directly while leaving more granular Eylea-specific pricing to bilateral negotiation that has not been disclosed publicly.

What the Regeneron fact sheet does, beyond closing the cohort, is provide the eighty-six percent market coverage number. That is the cleanest single metric the administration has put out for the whole program. It is also a number worth being a little careful with, because branded drug market share is not the same as total prescription volume share, and it does not capture the specialty versus retail mix or the public versus commercial payer mix. Eighty-six percent of the branded market is meaningful. It is not the same as eighty-six percent of US prescription drug spending, which depending on how you cut it is somewhere in the high seventies once you account for biosimilar penetration, generic dominance in the retail channel, and the segments of the branded market not covered by the seventeen.

What is in the deals and what is conspicuously missing

The deals are bilateral and confidential, which means the public-facing artifacts are the fact sheets and the TrumpRx browse page rather than any contract text. Drug-level coverage varies meaningfully across manufacturers. Some deals appear to cover the bulk of a manufacturer’s portfolio with MFN pricing on Medicaid and DTC discounts. Others appear to cover a narrower subset of selective SKUs with specific carve-outs. The fact sheets do not break this out at the level of detail anybody trying to model net pricing impact actually needs.

The framing that the administration has used, which is some version of the lowest prices in American history, applies primarily to Medicaid pricing and to select DTC offerings. It does not apply to commercial plan pricing in any direct way, and it does not apply to the bulk of US prescription spending because generics already dominate over ninety percent of total prescription volume. The MFN program touches the branded portion of the market, and within that portion it touches specific channels (Medicaid and DTC) more directly than others (commercial PBM-intermediated). That is not a criticism of the program. It is just a more accurate framing of what the deals actually do, which matters when modeling impact rather than scoring political points.

The AMCP analysis flagged the most important gaps directly. There is no published full contract text. There is no published reference country basket, meaning nobody outside the negotiation knows which countries’ prices are being used as the MFN benchmark. There is no published MFN calculation formula, which matters a lot because the difference between using a strict minimum versus a weighted average versus a basket median produces meaningfully different price points. There is no published state Medicaid implementation guidance, meaning the actual rebate reconciliation mechanics across fifty different state Medicaid programs are still being worked out. And there is no published drug-by-drug schedule, meaning anyone trying to calculate manufacturer-level revenue impact has to make assumptions about coverage scope that may or may not match what is actually in the contracts.

That set of gaps is where the analytical work has to focus, and it is also where the infrastructure opportunity sits. Somebody has to build the tooling that fills those gaps, because the manufacturers, the states, the PBMs, the employers, and the eventual Medicare touchpoints all need that information to operate.

IRA plus MFN as a quasi-voluntary hybrid

The structural way to think about this program is as a hybrid that sits on top of the Inflation Reduction Act’s Medicare drug price negotiation framework. The IRA gave HHS statutory authority to negotiate prices on a defined set of high-spend Medicare Part D drugs, with the price applicable across Medicare and tied to a defined methodology. The MFN program sits next to that as an executive-leverage tool that uses tariff threats, manufacturing onshoring, and the implicit rulemaking lever to extract pricing concessions across a broader set of channels and products.

The combination is unusual. The IRA is statutory and slow. It applies to a narrow product list per year, with the negotiation cycle stretching across multiple years and the maximum fair price taking effect after extended notice periods. The MFN program is executive and fast. It applies to whichever manufacturers come to the table, on whichever channels they agree to, with pricing taking effect on whatever timeline gets negotiated bilaterally. The two together cover more ground than either could on its own, and they create different exposure profiles for different manufacturers depending on portfolio mix.

The quasi-voluntary nature is worth dwelling on. None of the seventeen agreements are technically required by statute. They are extracted through the credible threat of regulatory action and trade pressure that would be more painful and less negotiable than the deal on offer. That is a different compliance dynamic than what the IRA produces. It also creates a different durability profile. A future administration could in theory unwind the MFN agreements faster than they could unwind the IRA framework, because the MFN structure does not have the same statutory anchor. That political risk is one of the things any analysis of the long-term durability of this pricing regime has to factor in.

The trade-policy bundling matters here too. The deals come paired with tariff exemptions on pharmaceutical inputs and manufacturing investment commitments in the US. That bundling makes the deals more durable in practice than they would be on pricing alone, because unwinding the pricing piece without unwinding the trade and manufacturing piece would create a coordination problem the manufacturers could exploit. It also means the program has a constituency outside HHS, which is unusual for a drug pricing reform and which probably extends its political half-life by several years.

The new adjudication layer and where the infrastructure gets built

The interesting business question is not whether drug prices went down. It is what new infrastructure gets built to operationalize MFN across the channels and over time. The answer is that the program creates a new adjudication layer that sits between manufacturer price commitments, Medicaid net pricing, DTC cash channels, international reference prices, and eventually Medicare and ERISA purchasing behavior. That adjudication layer needs real software to function, and most of it does not exist today.

The first piece is MFN price benchmarking. Real-time international price normalization is hard. Different countries publish different price points (list, net, ex-manufacturer, public payer), in different currencies, with different rebate structures, on different release schedules. Building a benchmarking engine that produces a defensible MFN reference price for a specific drug at a specific point in time is non-trivial software work and has to handle purchasing power parity adjustments, rebate normalization, and net price estimation where public data is incomplete. That is a real product category and it does not exist at production scale today.

The second piece is contract arbitration and compliance tooling. The agreements are bilateral, but the compliance burden is multilateral. Manufacturers have to honor MFN commitments across Medicaid (fifty states, each with its own rebate reconciliation), DTC (TrumpRx and successor platforms), and any other channels included in the deal. State Medicaid agencies have to verify that the rebates they are receiving actually reflect the MFN commitment. The administration has to be able to audit compliance. Nobody has built a piece of software that does all of this end-to-end, and the absence of published contract text makes the build harder, not easier.

The third piece is Medicaid and DTC routing. TrumpRx is the placeholder version. The real version needs eligibility verification, prescriber workflow integration, secondary payer coordination, and audit-grade pricing transparency. It also needs to coexist with the existing pharmacy benefit infrastructure rather than try to replace it, because the workflow lock-in that PBMs have built over decades is not going to break overnight just because there is a cheaper cash price available somewhere else. The platform that figures out how to slot into existing workflows while still capturing the MFN price advantage is the one that wins.

The fourth piece is employer fiduciary tooling, which is probably the biggest of the infrastructure layers in dollar terms. ERISA imposes fiduciary obligations on employer health plans, and the recent wave of pharmacy benefit fiduciary litigation (the Wells Fargo case being the most visible example) has put plan sponsors on notice that paying above-market prices for prescription drugs is a real liability exposure. When MFN creates a publicly visible benchmark price for a meaningful subset of branded drugs, the difference between what the plan is paying and what the MFN benchmark says is reasonable becomes a litigation-grade data point. The tooling that surfaces that gap, helps plan sponsors document their decision-making, and routes patients to lower-cost channels where appropriate is the kind of thing that has both legal urgency and clear willingness-to-pay attached to it.

The fifth piece is drug-level arbitrage and channel optimization. As the MFN structure matures, opportunities will emerge to route specific patients to specific channels based on drug, plan, eligibility, and price point. Cross-border price indexing engines, real-time benefit routing tools, and specialty carve-out optimization platforms will all become necessary as the channel landscape gets more complex. The patient experience layer for navigating which drug should be filled where is going to be a real product category, and the entrant that builds it with audit-grade methodology rather than marketing veneer is going to be the one that captures the institutional buyers.

Open questions, gaps, and what to watch next

A few things are worth watching closely as the program moves from announcement to operation. The first is the underlying contract text. As of now, none of the bilateral agreements have been published in full, and the AMCP analysis correctly flags that until the contracts are public, any analysis of actual pricing impact has to rely on the fact sheets and reporting. If and when contract text becomes public, the pricing methodology and reference country basket will be the key things to look at, because those determine whether the MFN benchmark is a real economic floor or just a rhetorical anchor.

The second is state Medicaid implementation. The deals commit manufacturers to MFN pricing on Medicaid, but the actual rebate mechanics flow through state Medicaid programs with their own supplemental rebate negotiations, formulary structures, and reconciliation processes. The states are going to have to operationalize this, and the variation in how different states handle it will create real differences in actual realized pricing. Watching how the largest Medicaid markets (California, New York, Texas, Florida) implement the MFN commitments will be informative, because what they do is going to set the template for the smaller states.

The third is TrumpRx evolution. The platform as it exists today is too primitive to handle real-volume DTC fulfillment. Either the administration builds it out or somebody else does. The question is whether the eventual real version is a government platform, a private platform with government endorsement, or a fragmented set of manufacturer-direct platforms that all interoperate with TrumpRx as a price discovery layer. Each of those outcomes has different implications for who captures value in the channel and where the workflow integration burden lands.

The fourth is commercial spillover. The deals as signed do not directly require MFN pricing in commercial plans, but the public visibility of MFN reference prices changes the negotiating dynamic for commercial PBM contracts. Plan sponsors are going to start asking why they are paying more than the public benchmark. That conversation is going to drive a lot of the actual net price compression in the commercial channel, even though it is not in any of the deal documents and will not show up in any White House fact sheet.

The fifth is pipeline implications. The deals lock in MFN pricing at launch for new innovative medicines, which changes the launch economics calculus for any new product coming out of the seventeen. That has effects on which therapeutic areas the manufacturers prioritize, how they think about US versus ex-US launch sequencing, and how they structure their pricing strategy for products in late-stage development. This is the part of the program with the longest tail and probably the largest cumulative impact, even though it is invisible in any single fact sheet and will not be measurable for several years.

The sixth, and the most important for anyone trying to make a real return on this regulatory shift, is the infrastructure stack. The benchmarking engines, the compliance tooling, the routing platforms, the fiduciary analytics, and the channel optimization tools all need to get built. The companies that build them well, with primary-source data and audit-grade methodology, are going to have a meaningful run. That is the actual investment angle, and it is what most of the social media coverage of the program completely misses while arguing about whether the price cuts are real or theatrical. Both can be true at once, and the entrepreneurs who recognize that are the ones who will end up with something to show for it five years from now.​​​​​​​​​​​​​​​​

The Problem This Is Actually Solving

What RAPID Actually Does (Mechanically)

TCET: The Predecessor That Ran Out of Room

Why Synchronization Is the Real Innovation

The Capital Markets Angle

Scope Constraints and Who Actually Benefits

AI-Enabled Devices and the New Category Question

What Comes Next

Abstract

CMS and FDA jointly announced the Regulatory Alignment for Predictable and Immediate Device (RAPID) coverage pathway on April 23, 2026. Key mechanics:

- Targets FDA-designated Class II and Class III Breakthrough Devices

- CMS issues proposed NCD same day as FDA market authorization

- 30-day public comment triggers; coverage potentially finalized within 60-90 days post-authorization

- Replaces the TCET pathway (paused for new candidates)

- ~40 devices currently eligible, ~20 additional potentially qualifying

- Devices must be subject to an IDE study enrolling Medicare beneficiaries with clinical endpoints jointly agreed by FDA and CMS

- Forthcoming Federal Register procedural notice opens 60-day public comment period before pathway is finalized

- Stanford Byers/Duke-Margolis survey: average 5 years from FDA auth to national coverage; RAPID targets ~2 months

- Core structural shift: FDA approval becomes a trigger event for CMS coverage workflow, not a separate proceeding

The Problem This Is Actually Solving

There is a failure mode that has existed in medtech for decades that people in the industry kind of just accepted as the cost of doing business. A device company runs a multi-year pivotal trial, clears FDA, throws a press release, and then waits. Not days. Not weeks. In some cases, years. Medicare, which covers a disproportionate share of the patients who need many of these breakthrough technologies, does not automatically cover a device just because FDA said it is safe and effective. Those are two entirely separate determinations, governed by two entirely separate legal standards, administered by two agencies that historically operated on two completely different clocks.

FDA asks whether a device is safe and effective. CMS asks whether it is reasonable and necessary for Medicare beneficiaries. Sounds like they should overlap almost entirely, and for the most part clinically they do, but the administrative machinery that produces each answer has never been synchronized. FDA authorization historically triggers nothing at CMS. CMS has to open its own NCD proceeding, gather its own evidence, run its own comment periods, and reach its own conclusion, and that process has averaged somewhere between one and several years depending on complexity and controversy. In the interim, a newly authorized device is in a kind of commercial purgatory. It is legal to sell. It is legal to implant. But the largest single payer in the country has not made a coverage determination, which means most hospitals are not going to stock it, most physicians are not going to recommend it, and the device company cannot build a commercial ramp worth anything.

A Stanford Byers Center for Biodesign and Duke-Margolis Center for Health Policy survey put the average time from FDA device authorization to national Medicare and commercial coverage at five years. Five. That is not a gap. That is a chasm. And it is not because the evidence is usually ambiguous or because CMS has good reason to doubt what FDA reviewed. It is mostly a structural problem – two agencies running sequential processes that were never designed to be connected. That is the failure mode RAPID is targeting, and it is worth being precise about what it is because the policy literature sometimes blurs it. The problem is not regulatory uncertainty. FDA’s Breakthrough Device program has been running since 2016 and has designated over 1,246 devices as of end of 2025. The problem is reimbursement uncertainty after regulatory certainty. Companies knew they could probably get FDA cleared. They had no idea when, or whether, CMS would follow.

What RAPID Actually Does (Mechanically)

Read more

- CMS paused the Part D leg of BALANCE for CY2027 via an HPMS memo on April 21, 2026, one day after the Part D parent org application deadline of April 20

- The stated reason: insufficient critical mass to clear the 80 percent NAMBA-weighted participation threshold baked into Section 2.3.1 of the March 2026 RFA

- GLP-1 Bridge (Section 402 demo) gets extended through 12/31/2027, originally scoped to run only 7/1/26 through 12/31/26

- Beneficiary price point on the Bridge stays at $50/month, operating outside the Part D benefit and payment flow

- Medicaid leg of BALANCE proceeds on track, state applications open through 7/31/26, participation start dates anywhere between 5/1/26 and 1/1/27

- Model drug list for CY2027 covers Zepbound, Mounjaro, orforglipron (pending FDA), Ozempic, Rybelsus, Wegovy, with a $245/month net price anchor on at least Zepbound KwikPen

- Cost sharing caps under BALANCE that plans never had to live with: $50/month EA and EGWP, $125/month AE/BA, $245 plus dispensing in the deductible phase, $0 catastrophic

- Narrowed risk corridor incentive (2.5 percent instead of 5 percent first threshold) apparently wasn’t enough to pull the industry across the 80 percent line

- The 340B rebate haircut of up to 5 percent, the WAC-based gross cost treatment, and the FAD PDE field all survive for future reconsideration

- Why this matters for investors, PBMs, manufacturers, RCM vendors, and anyone building infrastructure assuming Medicare anti-obesity coverage was a 2027 event

Table of Contents

What actually happened on April 21

The 80 percent math and why it was always going to be hard

What the RFA was actually asking plans to swallow

The Bridge as a bridge to what exactly

Manufacturer posture, pricing, and the WAC problem

Medicaid keeps rolling and why that matters more than it looks

The narrowed risk corridor incentive and why plans shrugged

340B, the FAD field, and operational plumbing that still has to get built

What the delay means for PBM formulary strategy

Read-throughs for investors and operators

What to watch between now and the CY2028 bid cycle

What actually happened on April 21

The memo hit HPMS on April 21, 2026, which was exactly one day after the application deadline for Part D parent organizations, and anyone who has ever worked a CMS model timeline saw that sequencing and immediately understood what it meant. CMS didn’t need a week to count the applications. The agency already knew by the night of April 20 whether the 80 percent NAMBA-weighted enrollment threshold had been cleared, and the speed of the response tells you the answer wasn’t close. When a threshold is missed by a hair, you usually get a few days of internal debate, maybe a week of back and forth with the biggest sponsors to see if anyone is willing to revise upward. A next-day memo means the miss was material.

The text itself is measured and bureaucratic, but the substance is that the Medicare Part D leg of BALANCE is paused for CY2027 pending further evaluation and data collection. The GLP-1 Bridge, which was originally designed as a six-month on-ramp running from July 1, 2026 through December 31, 2026, gets extended a full year beyond its original sunset to December 31, 2027. Part D sponsors are explicitly instructed not to indicate participation in the BALANCE Model within HPMS or the Bid Pricing Tool for CY 2027, which is the bureaucratic equivalent of closing the door and turning off the lights. The Medicaid side of the model continues on schedule, with state applications open through July 31, 2026, and states able to select start dates between May 1, 2026 and January 1, 2027.

The April 6, 2026 CY2027 Rate Announcement had already flagged that stakeholders were nervous. Commenters cited in the final announcement had specifically asked for the Bridge to run at least a full calendar year before BALANCE kicked in, and CMS punted that concern at the time by saying Innovation Center design was outside the scope of the rate announcement. Two weeks later the agency effectively granted the extension anyway, which suggests the internal read by early April was already that the threshold was wobbly and the fallback plan was being drafted in parallel to the application solicitation. That is not an indictment of anyone at CMMI. That is just how mature agencies run contingencies. But it does mean the pause was not a surprise to the people inside the building.

The 80 percent math and why it was always going to be hard

Section 2.3.1 of the March 2026 RFA lays out the threshold mechanics with uncommon clarity for a CMS document. The numerator is beneficiaries enrolled in Part D plans that applied to participate in BALANCE, restricted to plans included in the National Average Monthly Bid Amount calculation, so all eligible plan types plus Defined Standard plans, but excluding SNPs and EGWPs. The denominator is all Part D plans included in the NAMBA calculation, projected from February 2026 enrollment to CY2027. If that quotient lands below 80 percent, no Medicare launch.

Eighty percent is a stiff bar. The Part D market is not that concentrated if you define concentration loosely, but if you define it the way CMS was defining it for NAMBA purposes, you really only need four or five parent organizations to move in lockstep to get anywhere close. The usual suspects in terms of aggregate Part D enrollment are a familiar list: Humana, UnitedHealth, CVS Aetna, Centene, Elevance, Cigna, Kaiser in the regional plans, and a long tail. To get to 80 percent of NAMBA-weighted enrollment, the largest handful of these parents basically all had to say yes, with conviction, across both their MA-PD and PDP books.

The problem is that saying yes here was not a trivial operational or actuarial exercise. A Part D parent that opted in was committing to cover an entirely new drug class at a $50 or $125 copay, in the middle of a bid cycle where the CY2027 standalone PDP market was already wobbling from Part D redesign fallout. The basic premium stabilization demonstration for PDPs, the $2000 out of pocket cap, the expanded federal reinsurance mechanics, the sponsor exposure in the initial coverage phase, all of that was already reshaping how plans thought about formulary risk. Dropping a GLP-1 uncapped utilization bomb into a benefit that had been redesigned to shift more risk onto plans in the first dollar range was, politely, asking a lot. Less politely, it was asking plans to volunteer to eat adverse selection in a year where they were already being asked to eat adverse selection.

CMS tried to defuse the adverse selection concern in two ways. First, the 80 percent threshold itself was supposed to mean that if the market participated, no plan got stuck being the only one holding the bag. Second, the narrowed risk corridor option (2.5 percent instead of 5 percent on the first threshold) was supposed to give plans an additional hedge. Both of those only work if the critical mass actually shows up. Once one or two of the big five decide the math doesn’t pencil, the threshold becomes unreachable, and everyone else has an even stronger reason to sit out because now the adverse selection risk is concentrated rather than diluted. Classic coordination failure, the kind that voluntary CMMI models have historically struggled to escape.

What the RFA was actually asking plans to swallow

Reading the March 2026 RFA carefully, it becomes clear why a lot of plan actuaries spent the spring doing some very uncomfortable modeling work. Cost sharing was capped at $50 per 28- or 30-day supply for Enhanced Alternative plans and EGWPs during the initial coverage phase, and $125 per supply for AE and BA plans. During the deductible phase, patient exposure was capped at $245 plus a dispensing fee for a 28- or 30-day fill. The catastrophic phase sat at standard rules, which now means zero patient cost share post the Part D redesign. Participating plans had to apply these caps to every model drug from every participating manufacturer, uniformly, with no tiering discrimination across model drugs. Same tier, same cost share, no step therapy more burdensome than FDA labeling, and PA criteria no more burdensome than the specific criteria CMS defined in Section 2.2.5.

The PA criteria are worth lingering on because they are notable for what they permit rather than what they restrict. Provider attestation that the patient has type 2 diabetes, or noncirrhotic MASH with F2 to F3 fibrosis, or OSA, or is on lifestyle modification plus one of three BMI-plus-comorbidity ladders. The BMI ladder starts at 35 for unrestricted access, drops to 30 with a qualifying comorbidity (HFpEF, uncontrolled hypertension, CKD stage 3a+, moderate to severe OSA, or MASH with F2 to F3 fibrosis), and drops further to 27 with pre-diabetes, prior MI, prior stroke, or symptomatic PAD. Combine that with an Auto-Lookback provision that the RFA strongly encourages, where plans confirm the PA via automated ICD-10 review of health records without even bothering the provider, and what you have is a PA framework that is designed to be permissive, not restrictive. Plans that were hoping to use aggressive utilization management to control GLP-1 volume were being told, explicitly, that they couldn’t.

Then you add the formulary uniformity requirements. Every model drug, same tier, same cost share, no disadvantaging any one drug versus another except where FDA labeling forces a variation. This meant a plan couldn’t prefer Mounjaro over Zepbound, or Ozempic over Wegovy, or push patients toward orforglipron once it landed. Every model drug had to sit at parity. Combined with the WAC-based gross cost treatment described in Section 2.2.7 (waiving the maximum fair price ceiling for purposes of gross drug cost calculation), the model was asking plans to accept broad, uniform, permissively managed coverage with pricing mechanics they hadn’t previously dealt with in Part D.

The pricing itself is where it gets more interesting, because the RFA is coy but not entirely silent. Appendix C lists a $245 net price per month supply, tied at minimum to the Zepbound KwikPen presentations, with TBD markers on several other products and formulations. A $245 net monthly price is, in isolation, a meaningful discount from list and arguably from current plan net cost for commercial lives, but it is not transformative enough to offset the utilization demand shock of opening weight management coverage to a BMI 27 population with qualifying comorbidities. The actuarial question any plan was running was whether the negotiated rebate stack, plus the MDP discount, plus whatever the narrowed risk corridor provided, was enough to cover the volume that would predictably follow from handing out $50 semaglutide and tirzepatide to every qualifying beneficiary. For most plans the answer appears to have been no.

The Bridge as a bridge to what exactly

The Medicare GLP-1 Bridge is a Section 402(a)(1)(A) demonstration, which is a different statutory animal than the Section 1115A authority that powers BALANCE itself. Section 402 is the old Social Security Amendments of 1967 demonstration authority that lets HHS test changes in payment methods that increase efficiency and economy of Medicare services. It’s narrower in scope than 1115A but it also requires less procedural overhead, which is why CMS chose it for the Bridge. The Bridge sits outside the Part D benefit and payment flow, which means it doesn’t touch plan bids, doesn’t touch PDE, doesn’t touch the risk corridor, doesn’t touch DIR, and doesn’t touch the MDP. It is essentially a direct-to-beneficiary access mechanism, $50 per month for eligible Medicare beneficiaries, running from July 1, 2026 through December 31, 2027 under the extended timeline.

The question is what the Bridge is a bridge to. Originally the answer was clean: the Bridge was a six-month on-ramp to the January 1, 2027 Part D launch of BALANCE. Beneficiaries would get access starting mid-2026 under the demo, then transition into plan-based coverage starting in January. Now that BALANCE is paused, the Bridge runs for a full additional calendar year without any confirmed successor model. The memo’s language about additional time and data to inform potential implementation of BALANCE in Part D is carefully noncommittal. Potential means not definite. Data collection means the agency is giving itself optionality.

If you squint at this the right way, the Bridge extension is effectively the policy. The question of whether Medicare covers anti-obesity GLP-1s in 2027 has been answered in the affirmative, just not through Part D plans. It’s been answered through a Section 402 demo that sits alongside the program and provides access at a flat $50 to eligible beneficiaries. Plans aren’t on the hook. Manufacturers are presumably absorbing the discount delta between demo price and their preferred economics in exchange for volume access to the Medicare population on favorable terms. Beneficiaries get the drugs. Everyone kicks the hard plan-level design problem to CY2028 or later.

There are real limitations to the Bridge approach that will become clearer as the extension plays out. The demo is time-limited, which means manufacturer willingness to keep absorbing the pricing is bounded. The demo doesn’t build the formulary infrastructure or the claims data history inside Part D plans that CMS wanted BALANCE to build. The demo also doesn’t address the adverse selection question for Part D plans in any durable way, because plans aren’t actually carrying the coverage, so the actuarial experience generated is inside the demo rather than inside plan bids. When CY2028 comes around and CMS tries again (assuming it does), plans will still be looking at first-year demand shock without a meaningful internal book of business to price off of. The Bridge buys time but doesn’t solve the underlying information asymmetry.

Manufacturer posture, pricing, and the WAC problem

Eli Lilly and Novo Nordisk both agreed to participate in BALANCE, which matters because BALANCE is a voluntary model on both sides. Appendix C lists Zepbound, Mounjaro, orforglipron (pending FDA), Ozempic, Rybelsus, and Wegovy as the covered model drugs, with the net price anchor of $245 per month supply showing up clearly on Zepbound KwikPen and with TBD markers elsewhere that suggest final negotiations were still in flight as of the March RFA release. Both companies agreed to a “CMS-sponsored model” safe harbor pathway under 42 CFR 1001.952(ii) in lieu of a separate fraud and abuse waiver, and both committed to fund the lifestyle support platform at no cost to beneficiaries or plans.

The interesting mechanical piece is the waiver of Section 1860D-2(d)(1)(D), which says that the negotiated price of a selected drug must be no greater than the maximum fair price plus dispensing fee under the Negotiation Program. Semaglutide, notably, is on the Medicare Drug Price Negotiation Program list, with the negotiated MFP taking effect in 2027. By waiving 1860D-2(d)(1)(D) for purposes of BALANCE, CMS let plans treat gross drug costs based on WAC rather than the MFP ceiling, which materially changes the gross-to-net arithmetic and, importantly, changes how these costs flow through the Part D redesign risk corridor mechanics. This is surgical policymaking. It’s also a tacit acknowledgment that layering BALANCE on top of MFP without this waiver would have created weird incentives around reporting and payment reconciliation that no one wanted to deal with.

Now that BALANCE is paused in Part D, both manufacturers are left holding negotiated terms that have no immediate deployment venue in Medicare plan coverage. The Medicaid launches still happen, which gives the agreements partial relevance, and the Bridge presumably operates under some variant of the negotiated pricing architecture, but the big prize (MA-PD and PDP coverage with uniform formulary placement and low cost sharing driving volume) is on ice. For Lilly this is a pause on what would likely have been meaningful Zepbound and Mounjaro Medicare pull-through in 2027. For Novo Nordisk the picture is more complicated because of the MFP overhang on Ozempic and the competitive pressure on Wegovy, but the basic read is the same: negotiated economics that assumed a Part D volume channel now have less of a channel.

Orforglipron is the wild card here. Lilly’s oral GLP-1, pending FDA approval, sits in Appendix C with a TBD price. If it gets approved in 2026 or early 2027 (phase 3 data has been strong), the product enters a market where the Part D coverage architecture for anti-obesity indications is still effectively undefined. That is not a disaster for Lilly (the Bridge still provides access, Medicaid still covers, commercial coverage continues to expand), but it meaningfully reduces the near-term Medicare opportunity relative to what a BALANCE launch would have delivered. For a drug whose entire strategic thesis is displacing injectables via oral convenience in a volume-sensitive market, losing the Medicare Part D volume channel for a year is not nothing.

Medicaid keeps rolling and why that matters more than it looks

The memo’s confirmation that the Medicaid side of BALANCE proceeds on schedule is probably the most underappreciated piece of this whole story. State Medicaid agencies can apply through July 31, 2026, and can select participation start dates anywhere between May 1, 2026 and January 1, 2027. States that miss the January 1 window are out absent CMS discretion. The BALANCE Model webpage update on April 22 confirmed this timeline.

Here’s why this matters more than the Medicare pause suggests. Medicaid populations have historically been excluded from anti-obesity GLP-1 coverage in most states, with a handful of exceptions. The BALANCE negotiated pricing, combined with Section 1115A waivers that let CMS bypass the statutory Medicaid drug rebate mechanics for model purposes, gives state Medicaid agencies an actually affordable way to open up access. States that have been under political pressure to expand obesity coverage but couldn’t make the budget math work now have a CMS-negotiated path that materially reduces the per-member cost.

From an investment standpoint, any thesis that was predicated on Medicare Part D as the near-term volume catalyst for Medicare-age GLP-1 demand has to get rewritten, but the Medicaid side is arguably more interesting now because it is proceeding without the 80 percent critical mass problem that killed the Part D launch. States join one at a time, CMS doesn’t need a nationwide commitment, and the pricing economics may actually be more favorable for manufacturers on a net basis because Medicaid already has the baseline rebate infrastructure that model pricing gets layered on top of. The watch list here is which states move first. Larger states with recent Medicaid expansion energy and governors who have publicly talked about obesity as a health policy priority are the obvious candidates. The July 31, 2026 application deadline is the near-term action window.

The narrowed risk corridor incentive and why plans shrugged

Section 2.4.1 of the RFA lays out the optional narrowed first risk corridor threshold, which was one of the two major incentives CMS offered plans to offset the participation risk. Under standard Part D risk corridors, the first threshold sits at plus or minus 5 percent of target amount, with plans bearing 100 percent of the variance within that band. BALANCE offered eligible plans the option to narrow that first threshold to plus or minus 2.5 percent, effectively reducing the plan’s first-dollar bid variance exposure by half. The 50/50 and 80/20 corridors beyond the first threshold stayed the same.

The catch, and it’s a real catch, is that the narrowed corridor only activates for plans whose model drug utilization rate exceeds one standard deviation above the mean for their plan type among all participating plans that opted in. Appendix D spells out the triggering event methodology: identify participating plans by type (C-SNP, I-SNP, D-SNP, MA-PD, PDP), compute plan-level utilization rates as December enrollees with at least one model drug PDE divided by total December enrollment, calculate mean and standard deviation by plan type, and eligible plans are those with utilization rates more than one standard deviation above the mean.

The problem with this structure is that it only helps plans that get slammed hardest with utilization, and it only helps them on the first 2.5 percent of cost variance. If you’re a big PDP with a moderately bad utilization experience (say half a standard deviation above the mean), you get no relief. If you’re a plan with truly catastrophic utilization (three standard deviations above the mean), the 2.5 percent relief is a rounding error relative to the actual cost overrun you’re carrying. The narrowed corridor is designed to help plans with adverse selection at the margin, not plans that experienced large-scale demand shocks. And adverse selection in anti-obesity coverage for Medicare isn’t really a marginal concern. It’s potentially structural.

Plans did the math and concluded that the incentive wasn’t enough. That’s the most honest read of the participation miss. CMS offered a modest risk corridor sweetener, manufacturers offered negotiated pricing, CMS waived a bunch of statutory constraints to make the mechanics work, but at the end of the day the plans that model this stuff for a living looked at the combination and said no thanks. That’s a signal worth paying attention to, because it tells you that the next iteration of BALANCE (or whatever its successor is named) needs meaningfully stronger plan-level financial protection, or meaningfully more favorable pricing, or both. The policy didn’t fail because the idea was bad. It failed because the economic package didn’t clear plan hurdle rates at the level of market coordination required.

340B, the FAD field, and operational plumbing that still has to get built

One of the more technically interesting pieces of the RFA is Section 2.2.8, which addresses the 340B adjustment. Model rebates get adjusted downward by an amount not to exceed 5 percent to account for units purchased by 340B-covered entities at discounted prices. This is CMS acknowledging that manufacturers can’t reasonably be expected to pay a full model rebate on top of a 340B discount, which would create double-discounting in a way that breaks the drug pricing stack. The 5 percent cap is specific, which suggests CMS and manufacturers negotiated hard on exactly how much 340B leakage the model would absorb.

Section 2.2.7 introduces the Facilitated DIR (FAD) field on the PDE, which is a new piece of technical infrastructure specifically for the model. The FAD field calculates manufacturer rebate obligations as the difference between plan-reported ingredient cost on PDE and the sum of GLP-1 Discounted Price plus MDP amount. Manufacturers get invoiced quarterly through the existing Manufacturer Payment Portal but on separate model-specific invoices. Plans don’t have to report the FAD rebate on the DIR Report for payment reconciliation, but CMS will incorporate FAD amounts when calculating annual Part D reconciliation.

This is genuinely new plumbing. The PDE format has been modified for this model, the payment portal has been extended, and the reconciliation mechanics have been adjusted. CMS has presumably already built or is building this infrastructure, because the model was supposed to launch January 1, 2027 and you don’t spin up PDE field changes in a quarter. That infrastructure now sits idle for a year, which is not the end of the world but it is a real sunk cost that the pause puts in limbo. When CY2028 comes around and CMS tries to relaunch BALANCE (or its successor), the technical pieces should still be largely in place. That’s one of the quieter silver linings of the pause: the operational burden of cold-starting the model for a later year is lower than it would have been if CMS hadn’t already sunk the infrastructure work.

For RCM vendors, pharmacy IT vendors, and anyone whose roadmap was assuming the FAD field would go live January 1, 2027, the pause is a timing reset but not a cancellation. The spec exists, the field is defined, and once model participation re-emerges, the plumbing is ready. Vendors who were mid-build should not rip out the work. They should probably slow the timeline and reallocate engineering resources to more urgent near-term priorities, but the investment is not stranded.

What the delay means for PBM formulary strategy

PBM formulary teams have had a fun 2026, and the BALANCE pause adds another variable to an already complex model. The CY2027 standalone PDP market was going to be challenging regardless, with the Part D redesign fully absorbed, the $2000 OOP cap creating first-dollar plan exposure, and the MFP round one drugs starting to flow through at negotiated prices. GLP-1 utilization management under BALANCE would have been meaningfully different from commercial book utilization management, with CMS-defined PA criteria that are permissive by historical standards and uniform formulary placement requirements that prevent the normal lever-pulling on tiering and step therapy.

With BALANCE paused, PBM formulary strategy for CY2027 reverts to status quo ante. Anti-obesity GLP-1 coverage remains not required and largely not provided in Part D. Commercial book coverage continues to expand at the pace employers choose to pay for, which is expanding but not uniformly. Medicaid coverage expands unevenly by state. The Bridge operates outside of plan formulary workflows entirely, so PBMs don’t need to integrate Bridge beneficiaries into their formulary tools.

The medium-term question is what PBMs do with their internal planning for a BALANCE 2.0. The big PBMs presumably had workstreams stood up to support plan-sponsor clients in BALANCE participation, including PA adjudication, claims routing, MAC reimbursement logic, and reporting. Those workstreams should probably not be wound down entirely because the model is likely to return in some form. But they need to be rescoped for a delayed timeline, which means headcount decisions, vendor contract decisions, and internal prioritization decisions. PBM CIOs and CFOs are probably having slightly unpleasant conversations this week about capitalized development costs and expected go-live dates.

The more interesting strategic question for PBMs is whether the BALANCE pause creates an opening for private negotiation with manufacturers on GLP-1 pricing for Medicare lives on a plan-by-plan basis. If CMS isn’t going to coordinate the market through a multi-lateral demo, nothing in the waiver framework prevents individual plans from negotiating individual rebate deals. Whether manufacturers are willing to engage in that is a different question, and historically they have been reluctant to carve up Medicare channels because of MDP and rebate best-price exposure. But the BALANCE waivers showed that these constraints can be bent for the right demo structure. Sophisticated PBMs are probably already sketching out what a private, bilateral version of BALANCE might look like, using CMS’s model architecture as a template.

Read-throughs for investors and operators

For investors in anti-obesity drug manufacturers, the BALANCE pause is a near-term revenue headwind for 2027 Medicare volume, partially offset by continued Bridge access and Medicaid expansion. Consensus models that assumed Part D coverage kicking in January 1, 2027 need to be revised. The magnitude depends on what percentage of 2027 GLP-1 Medicare revenue was going to flow through Part D plan coverage versus the Bridge. Back of the envelope, the Bridge operates at $50 beneficiary cost share with CMS-negotiated manufacturer net pricing, which is broadly similar to the BALANCE net pricing architecture. The real difference is reach and enrollment. Plan-based coverage hits everyone enrolled in a participating plan with minimal friction. Bridge enrollment requires beneficiary action to opt in, which meaningfully reduces effective penetration.

For investors in GLP-1 adjacencies (obesity-related SaaS, lifestyle platforms, nutrition services, remote monitoring, telehealth weight management), the pause is a mixed signal. The lifestyle support platform requirement in BALANCE was going to create real commercial opportunity for platforms that could serve participating plans. That opportunity is delayed. But the underlying demand curve for obesity management services isn’t changing. Commercial coverage expansion continues. Medicaid expansion accelerates in certain states. The Bridge creates a large Medicare population with active GLP-1 treatment who need wraparound services. Companies in this space should not over-index on the BALANCE pause as a demand signal. The demand is still there, just flowing through different channels.

For investors in Medicare Advantage plans and PDPs, the BALANCE pause is a near-term positive. Plans avoid the adverse selection risk of opt-in participation, they avoid the bid complexity, and they avoid the PDE format changes that were going to require IT work. CY2027 bids are simpler than they would have been, actuarial assumptions are more stable, and the premium stabilization challenges of the 2027 standalone PDP market don’t have a GLP-1 overhang to complicate them. This is a small positive rather than a large one because plans were already going to participate or not on a voluntary basis, but sentiment and bid predictability both improve.

For investors in health IT infrastructure, including pharmacy connectivity, PBM plumbing, revenue cycle management, and drug pricing tools, the pause is a timing reset. The FAD field spec exists, the payment portal extensions exist, the HPMS participation flags exist. None of that infrastructure gets deployed in production for CY2027. Vendors that built toward a January 1 launch are sitting on completed or near-completed features waiting for a use case. The right strategic response is to keep the capability maintained but not to keep burning engineering cycles on enhancement. When BALANCE 2.0 or its successor emerges, the lead time to reactivation should be short.

For entrepreneurs building in the prior authorization, formulary management, and specialty drug access space, the BALANCE pause preserves the status quo for one additional year in Medicare. That is either good or bad depending on the specific product thesis. Products that helped plans manage BALANCE-specific PA under permissive CMS-defined criteria lose a use case. Products that help plans manage non-BALANCE PA (which is still the reality for anti-obesity GLP-1s in Medicare outside the Bridge) continue to have the same market as before.

What to watch between now and the CY2028 bid cycle

The near-term watch list is specific and manageable. The July 31, 2026 Medicaid application deadline is the first major signal. How many states apply, which states, and what their projected enrollment looks like will tell you how serious the Medicaid leg of BALANCE becomes in the real world. The states that move first will create the early evidence base that CMS uses to argue for a Medicare relaunch.

The Bridge launch on July 1, 2026 is the second major signal. How smoothly the access mechanics work, how quickly beneficiary uptake scales, what the actual utilization curve looks like, and whether there are any surprises in manufacturer supply or pharmacy dispensing all feed into the evidence base for CY2028 planning. Bridge data is exactly what CMS cited in the April 21 memo as the basis for future BALANCE implementation decisions. The quality and completeness of that data matters.

The CY2028 Advance Notice, which typically drops in January or February 2027, is where CMS will signal whether BALANCE is getting a second attempt for plan year 2028 or whether the agency is pivoting to a different architecture entirely. Watch the language around Innovation Center GLP-1 activity in that notice carefully. If BALANCE language reappears in substantive form, the relaunch is on track. If the language softens to generic references about continuing to evaluate demonstration options, the relaunch is at risk of being delayed further or restructured.

The FY2027 appropriations fight will matter too. CMMI’s authority is broad under Section 1115A, but political dynamics around obesity coverage, drug pricing, and Medicare spending have intensified, and Congress has shown increasing willingness to weigh in on specific Innovation Center models through hearings, letters, and appropriations rider discussions. Any signal from key committees about BALANCE specifically or about anti-obesity Medicare coverage generally is worth tracking.

Finally, the CY2028 Part D bid cycle itself, which runs through spring and summer 2027, is where the next practical test of plan willingness comes. If CMS tries to relaunch BALANCE for CY2028 with meaningfully stronger incentives (narrower risk corridors across the board, not just for top-quartile utilizers, or higher guaranteed rebate stacks, or some form of direct federal backstop), plans will look at the package and decide again. The 80 percent threshold stays a hard constraint unless CMS lowers it, which would be a significant policy concession. Watch whether the threshold gets revisited. That single number tells you most of what you need to know about whether the next attempt is designed to succeed or designed to be a second attempt with similar odds of missing.

The BALANCE pause is not the end of Medicare coverage for anti-obesity GLP-1s. It is an iteration in a multi-year design process that is clearly still underway. The Bridge extension buys the agency time, preserves beneficiary access, keeps the manufacturer negotiations warm, and generates the utilization data that will inform the next attempt. Plans got a reprieve on a risk they didn’t want to take this year. Manufacturers lost a Medicare Part D volume channel but kept the Medicaid leg and the Bridge. Investors in the space had to revise their 2027 Medicare volume assumptions but the underlying demand thesis is unchanged. The interesting question, for everyone who has been tracking this closely, is whether the next attempt looks fundamentally like BALANCE with better incentives, or whether CMS comes back in a year with a meaningfully different architecture. That answer starts coming into focus in the CY2028 Advance Notice, and it fully reveals itself in the CY2028 bid results next summer.​​​​​​​​​​​​​​​​

Abstract

Why this is the moment regulation accidentally built infrastructure

The prior auth stack nobody asked for but everyone needs

CRD, DTR, PAS and what each layer actually does

Fax machines, X12 278, and the orchestration tax

State laws are turning UM into an SLA business

Continuity of care is a state machine problem pretending to be a policy

AI in UM, or why the sole decider framing is the wrong one

Where the venture dollars land in PA infrastructure

Price transparency graduates from PDF dumps to a computation layer

The pricing graph and why 835 data is the anchor

ERISA litigation turns pricing data into evidence

AEOB pushes pricing into the exam room

The normalization problem that eats naive analyses

Business models in transparency 2.0

Closing thoughts on programmable healthcare

Abstract

Two regulatory vectors are quietly converging into something much bigger than either one looks on its own.

- Prior auth is being refactored from a fax-and-phone labor pile into FHIR-native API infrastructure, driven by AHIP and BCBSA commitments, CMS-0057-F, ONC certification criteria, HL7 Da Vinci, and a growing stack of state SLA laws.

- Price transparency is moving from estimated allowed amounts and chargemaster math to actual paid percentiles derived from 835 ERA data, which turns compliance files into a bidirectional pricing graph.

- ERISA fiduciary litigation (Lewandowski, Navarro) is converting that pricing graph from optional analytics into discoverable evidence, which forces employers to actually use it.

- AEOB under the No Surprises Act pushes pricing upstream into clinical ordering workflows, where it starts behaving like a decision engine rather than a retrospective report.

- Net result: medical necessity becomes programmable, pricing becomes executable, and a handful of orchestration, compute, and audit layers become venture-scale infrastructure opportunities.

Why this is the moment regulation accidentally built infrastructure

Healthcare usually gets infrastructure by accident. Someone writes a rule, a bunch of lawyers interpret it, a bunch of engineers go build to the lowest-effort reading of that interpretation, and ten years later the industry wakes up and realizes a new substrate exists. That is roughly what is happening right now across two completely different regulatory tracks that are starting to rhyme.

On one side, prior auth is getting dragged out of fax hell by a combination of voluntary payer commitments, federal interoperability rules, and increasingly assertive state SLA laws. On the other, price transparency has spent five years being a joke about unreadable JSON dumps and is finally shifting toward actual paid percentiles that reflect real money that changed hands. Both tracks were sold as compliance exercises. Both are quietly turning into market infrastructure that vendors, providers, payers, and employers will build entire businesses on top of.

The common thread is that regulators keep mandating structured, machine-readable disclosures of things that used to live in PDFs, policy manuals, or somebody’s head. Once those disclosures exist in enough volume and enough structure, they stop being filings and start being computable substrates. Computable substrates get products built on them. Products attract capital. Capital attracts talent. Eventually what looked like a compliance cost center becomes a transaction layer, and the economics of the whole adjacent market get rewritten. That is the lens worth keeping in mind for the rest of this essay.

The prior auth stack nobody asked for but everyone needs

Commercial prior auth has always been a great example of Conway’s law applied to healthcare. The org chart of utilization management (nurse reviewers, medical directors, BPO call centers, fax intake teams, delegated UM vendors) produced a transaction topology that looks exactly like that org chart. Fax in, portal in, phone in, nurse review, medical director escalation, letter out, appeal loop, repeat. The technology budget mostly went to making that labor pile slightly less painful rather than replacing it.

That is finally breaking, and not because anybody had a technological epiphany. It is breaking because the payer associations publicly boxed themselves in. AHIP and BCBSA issued commitments pointing at a FHIR-based framework for electronic prior auth by the start of 2027, with at least 80 percent of electronic approvals with complete clinical documentation answered in real time. The 2026 commitments already in motion include reduced PA scope, 90-day continuity of care when patients switch plans, clearer explanations of decisions, and medical review of clinically non-approved requests. That is not a federal rule for the full commercial market, but when plans covering close to 270 million lives publicly line up behind the same operational targets, vendors and providers effectively have to build for it. The alternative is being the one EHR or clearinghouse that cannot ingest the standard flow, which is a short path to losing deals.

Meanwhile the federal rails are converging on the same stack. CMS-0057-F requires impacted payers to expose prior auth through FHIR APIs and supports operational changes around turnaround times and data exchange. ONC’s HTI-1 certification criteria explicitly cover provider-side prior auth APIs for Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support. The CMS rule is narrower in scope than the commercial market, but the ONC certification criteria apply to certified health IT, which is basically everybody who matters on the provider side. So even where the payer mandate does not reach, the provider stack is being nudged toward CRD, DTR, and PAS. Commercial infrastructure piggybacks on that whether the commercial payer loves it or not.

The baseline is still genuinely primitive, which is why the opportunity is so large. CAQH reports that only about 35 percent of prior authorizations are processed electronically, and a striking 9 percent of surveyed organizations say they could support an ePA API by the 2027 target. Blue plans themselves acknowledge that nearly half of PA requests are still coming in by fax or phone. CAQH estimates that full adoption of the electronic standard could save the industry on the order of 515 million dollars a year and cut about 14 minutes per authorization. Those are the kinds of gaps that create new categories of company, not just feature upgrades inside existing ones.

CRD, DTR, PAS and what each layer actually does

Read more

Welcome to Healthcare Markets & Technology

This newsletter covers the business, policy, and technology forces reshaping the U.S. healthcare system — written for investors, operators, and entrepreneurs who need to stay ahead of the curve.

We publish 5–7 times per week across eight topic areas. With 521 articles in the archive, here is how to find exactly what you are looking for.

📚 The Knowledge Base — Your Best Starting Point

The fastest way to explore the full archive is the Healthcare Markets & Technology Knowledge Base:

→ kb.onhealthcare.tech

The Knowledge Base lets you:

• Search across all 521 article titles, summaries, and topic tags

• Filter by section — Prior Auth & Interoperability, Medicare & Payer Strategy, Clinical AI & Patient Care, AI Strategy, Health Tech Infrastructure, Health Tech Investing, Digital Health & Startups, Health Policy & Regulation

• Sort by Most Viewed — find the articles readers return to most

• Filter by access level — browse free articles or subscriber-only deep dives

• Explore topic tags — 40+ tags including Medicare Advantage, prior authorization, digital health, AI diagnostics, value-based care, and more

What We Cover

The newsletter is organized into eight sections. Here is a quick guide to each:

Prior Auth & Interoperability — CMS rulemaking, FHIR APIs, payer-provider data exchange, and the regulatory battle over prior authorization. 93 articles.

Medicare & Payer Strategy — Medicare Advantage, value-based care models, ACO REACH, CMMI innovation, and commercial payer strategy. 109 articles.

Clinical AI & Patient Care — AI diagnostics, clinical decision support, ambient documentation, and the deployment of AI at the point of care. 110 articles.

AI Strategy, Market & Investment — The business of AI in healthcare: market sizing, M&A, competitive dynamics, and enterprise adoption. 76 articles.

Health Tech Infrastructure & Ops — EHR systems, revenue cycle management, cloud infrastructure, and the operational backbone of health tech. 59 articles.

Health Tech Investing & Venture Capital — Venture funding trends, notable deals, investor theses, and the startup ecosystem. 30 articles.

Digital Health & Startups — Consumer health, telehealth, digital therapeutics, and emerging startup categories. 23 articles.

Health Policy & Regulation — FDA, CMS, Congress, and the regulatory environment shaping healthcare markets. 21 articles.

Free vs. Subscriber Content

Approximately half the archive is free. Subscriber-only articles are the longer, more data-intensive deep dives — market analyses, investment frameworks, and regulatory breakdowns that take 30–60 minutes to read. Free articles cover the same topics at a higher level.

You can filter by access level in the Knowledge Base to see exactly what is available to you.

Most-Read Articles

• The Medicaid Tech Pledge: Why 600 Million in Savings Means Almost Nothing — 6,735 views

• Decentralized Insurance Protocols: A Model for Transforming the Insurance Industry — 5,170 views

• Rural Health Transformation Program: Strategic Playbook for Healthcare Builders — 5,126 views

• What the Leaked Claude Code Codebase Tells Healthcare Builders About Deploying AI — 5,122 views

• Beneath the Surface of CMS Innovation: A Strategic Analysis of the FY 2026 Budget — 5,033 views

• The Longest ACCESS Article You'll Ever Find: CMS Builds a Chronic Care Revolution — 4,545 views

• Bundles Are Back, Now Mandatory and Nationwide: A Builder's Field Guide — 4,493 views

• Clinical Trials Are the New Bottleneck: AI Drug Discovery Has Created a New Crisis — 4,084 views

• The PCP as Specialist: How AI and Virtual Consults Will Collapse the Referral Economy — 4,075 views

• UnitedHealth's 2025 Earnings Call: What Health Tech Builders Need to Know — 4,033 views

• The Gold Rush is Over, Now We Sell Shovels — 3,825 views

• The $1.8B Ozempic Middleman and What It Actually Means for Health Tech — 3,734 views

• CMS Just Opened a $100M Door for Lifestyle Medicine Startups (And Most Missed It) — 3,686 views

• Clinical Reasoning vs. Documentation: The Next Battleground — 3,590 views

• Epic's Agent Factory and the End of the Middle Layer: What Health Tech Builders Need to Know — 3,554 views

• The Coming Collision Between Foundation Models and Regulated Clinical AI — 3,550 views

• The Corporate Healthcare Paradox: When Your Boss Becomes Your Doctor — 3,535 views

• The Standardization Trap: Why Deploying AI Agents in Healthcare Requires a New Playbook — 3,505 views

• ACO LEAD Enablement Platform Business Plan and Technical Architecture — 3,371 views

• OpenEvidence Business Case: Monetization Strategy Analysis — 3,269 views

Or explore the full ranked list at kb.onhealthcare.tech — sort by "Most Viewed" to see all 521 articles ranked by popularity.

- Thesis: PA is shifting from labor-arbitrage cost containment to API-driven infrastructure; value is migrating from BPO and in-house staff to software, data, and middleware

- Regulatory stack: CMS-0057-F (Jan 2024 final, Jan 2027 compliance, four FHIR APIs), CMS-0062-P (Apr 2026 proposed, Oct 2027 proposed compliance, drug PA), ONC HTI-1 (EHR certification), AHIP/BCBSA June 23, 2025 commitments covering 257M Americans, state laws in WA, NE, TX, AR, MD, CA, VA, IN, AK, MI, IA, IL, VT, CO

- Scale of dysfunction: 39 PAs/week per physician, 13 hrs/week of physician+staff time, 40% of practices have dedicated PA staff, 29% of docs report a serious adverse event from PA delay, only 35% of PAs processed electronically (CAQH), only 9% of surveyed orgs could support an ePA API by 2027 (CAQH), nearly half of PA requests still submitted by fax or phone per BCBSA Jan 2026, $515M annual CAQH savings estimate, $15B CMS 10-yr savings estimate

- Critical regulatory unlock: CMS granted enforcement discretion in 2024 allowing an all-FHIR PA workflow in place of the legacy X12 278, effectively waiving the HIPAA X12 mandate for PA and opening the door to pure-FHIR infrastructure

- Four CMS-0057-F APIs: Patient Access, Provider Access, Payer-to-Payer (the mechanism for 90-day continuity carryover, shipping up to 5 years of claims, encounters, USCDI data, and PA history between plans on patient opt-in), Prior Authorization

- Technical stack: HL7 Da Vinci PA suite (CRD for discovery, DTR for documentation, PAS for submission/adjudication), FHIR-to-X12 bridge available but no longer required, CDS Hooks cards in EHR workflow

- AI boundaries: state laws (MD HB0820, CA SB 1120, NE LB 77, CA SB 363) require individualized basis, mandate human decision-making, require quarterly audits, impose up to $1M per case fines for high appeal-overturn rates; nH Predict (UnitedHealth) and PXDX (Cigna) as cautionary tales

- Opportunity map: provider-side orchestration, payer-side FHIR middleware (“PA as a service”), PA portability/Payer-to-Payer layers, AI audit and compliance tooling, PA-aware clinical decision support, patient-facing PA transparency and appeal assistance, specialty benefit manager modernization, and monetization of the public-reporting PA dataset

- Named players: provider-side (Cohere, Rhyme, Infinitus, Myndshft, Infinx, Anterior, Itiliti Health); payer infra (Smile Digital Health, Firely, HealthEdge, CareEvolution); specialty benefit managers (Evolent, eviCore, Carelon, Lumeris) as fragmented modernization targets

- Honest risks: payer foot-dragging via thin FHIR veneers, dual-stack necessity during transition, gold card complexity varying across states, consolidation pressure from clearinghouses and EHRs, utilization rebound as PA becomes frictionless

Table of Contents

How Bad Is It Actually

The Adoption Gap Nobody Wants to Talk About

The Federal Rails and the Four APIs of CMS-0057-F

The Quiet Unlock: CMS Waives X12 for PA

CMS-0062-P and the Drug Rule

The June 2025 AHIP Announcement and Why 257M Is the Real Number

States Are Writing the SLA

Gold Carding as a Data Problem in Disguise

The 90-Day Carryover Is a Payer-to-Payer API Problem

AI Guardrails and Where the Lawsuits Are Pointing

The Da Vinci Stack in Plain English

Where the Plumbing Actually Breaks

What AI Can and Cannot Do Here

Provider-Side Orchestration as a Business

Payer-Side FHIR Middleware

The Portability Layer Nobody Owns Yet

Compliance Tooling for the Algorithmic Audit Era

PA-Aware Clinical Decision Support

Patient-Facing PA Transparency and Appeal Tools

Specialty Benefit Manager Modernization

The Dataset Is the Real Prize

Incumbents, New Entrants, and Where the Whitespace Is

Honest Risks and What Could Go Sideways

Closing Thoughts

How Bad Is It Actually

Before getting into the opportunity, it helps to sit with how genuinely broken the current state is, because the scale of the dysfunction is what makes the rebuild economically obvious. The AMA’s 2024 Prior Authorization Physician Survey, which pulled responses from 1,000 practicing docs, reads like a clinical fever chart. Physicians are knocking out an average of 39 PA requests per week, burning roughly 13 hours of combined physician and staff time to do it. Forty percent of practices have dedicated PA staff who do literally nothing else. About one in three physicians say their requests get denied often or always, and 75 percent say the denial volume has climbed over the past five years.

Then there’s the part that should make any policymaker queasy. Ninety-three percent of physicians report that PA delays necessary care, 82 percent say it leads to treatment abandonment, and 29 percent, which is more than one in four, report that PA has caused a serious adverse event for a patient under their care. Hospitalizations in 23 percent of cases. Life-threatening events in 18 percent. Permanent disability or death in 8 percent. For a process whose entire justification is cost containment, the morbidity tail is unusually loud.

The money side is just as ugly. The CAQH 2024 Index pegs the savings from full ePA adoption at $515 million annually, with 14 minutes of staff time shaved per authorization compared to the current mixed bag of portals, faxes, and the occasional API. CMS has projected $15 billion in savings over ten years from its interoperability rule alone. Those numbers are the market size. They explain why every incumbent clearinghouse, EHR vendor, UM platform, and health tech seed company is suddenly interested in a transaction type they mostly treated as infrastructure plumbing five years ago.

The Adoption Gap Nobody Wants to Talk About

The most damning numbers in the CAQH 2024 Index are not the savings figures. They are the adoption figures. Only 35 percent of prior authorizations are currently processed electronically at all. That is not “not fully automated.” That is “roughly two-thirds of all PA transactions in American healthcare still move on paper, fax, portal, or phone in 2024.” Every other major administrative transaction in healthcare (eligibility, claims, remittance) has adoption rates above 90 percent. PA is the last unreconstructed workflow in the whole X12 catalog.

The second number is worse. Only 9 percent of surveyed organizations reported that they could currently support an ePA API of the kind CMS-0057-F mandates by January 1, 2027. Nine percent. That is not a compliance gap, that is a compliance chasm, and it is the single most important statistic in the entire PA economy. It says the industry has roughly eight months of actual build time from the publication of this essay to stand up infrastructure that 91 percent of surveyed orgs cannot yet support. Either the rule gets watered down or delayed, which is possible but not assumed, or the next 14 months are going to be a historic scramble for FHIR-native middleware, systems integrators, and anyone who can plausibly claim to ship production-grade FHIR endpoints at payer scale. Market-sizing exercises that ignore the 9 percent number are missing the scale of the urgency.

BCBSA in a January 2026 article confirmed the provider-side picture bluntly: nearly half of PA requests are still submitted by fax or phone. Half. In 2026. At payer plans that are publicly committed to 80 percent real-time ePA by January 2027. The gap between the aspirational commitment and the operational reality is roughly the size of the opportunity.

The Federal Rails and the Four APIs of CMS-0057-F

The piece that actually forces the rebuild is CMS-0057-F, the Interoperability and Prior Authorization Final Rule that CMS dropped in January 2024. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the federally-facilitated exchanges. The operative word is breadth. These plans collectively cover a huge slice of the insured population, and by January 1, 2027 they all have to implement a Prior Authorization API built on HL7 FHIR standards. In addition, payers must send PA decisions within seven days for standard requests and 72 hours for urgent ones, and provide a specific reason for any denial.

What tends to get lost in casual coverage is that CMS-0057-F actually requires four distinct FHIR APIs, not one. The Prior Authorization API gets the headlines because it is the operational showpiece, but it is only one layer of the stack. The other three are just as important to the economics of the new PA economy, and each of them underpins a different business model category.

The Patient Access API requires payers to make claims, encounter data, formulary information, and (by 2027) PA information available to members through third-party apps on request. This is the rail that lets patients see their own PA status, approvals, denials, and the reasons for those decisions in real time through consumer-grade apps. The Provider Access API requires payers to share claims, encounters, and PA data with in-network providers for attributed members, which gives clinicians longitudinal visibility into prior care and prior PA history when they are making a decision. The Payer-to-Payer API is the most operationally consequential for the portability business model: when a member opts in, the previous payer must ship up to five years of claims, encounter data, USCDI-aligned clinical data, and PA history to the new payer. That is the technical mechanism by which the 90-day continuity of care carryover actually happens. And the Prior Authorization API is the real-time decisioning surface.

These four APIs together constitute the FHIR rail layer. Every business model in the new PA economy sits on top of one or more of them. Treating “the PA API” as the whole story is like treating the checkout step as the whole story of e-commerce. The sleeper provision in CMS-0057-F, separate from the APIs themselves, is the public reporting mandate. Payers have to annually report approval rates, denial rates, average decision timeframes, and the percentage of requests approved only after appeal. This is the first time in American health insurance history that PA behavior becomes a standardized, comparable, public dataset. The implications for analytics, benchmarking, and market access products are enormous and mostly unpriced.

ONC’s HTI-1 final rule closes the loop on the EHR side by updating the Health IT Certification Program to require certified EHRs to support FHIR-based data exchange. You can have all the payer APIs in the world, and if the EHR cannot consume them cleanly, the value never reaches the clinician. HTI-1 fixes that on the certification side, though actual vendor implementation quality is a separate and more cynical conversation.

The Quiet Unlock: CMS Waives X12 for PA

This is the piece of the regulatory package that does not get nearly enough attention outside the standards community, and it is arguably the single most important enabler of the new infrastructure category. Under HIPAA, electronic PA transactions have historically been required to use the X12 278 standard. That requirement is what kept the clearinghouse ecosystem in the middle of every PA, because clearinghouses are the plumbing layer for X12 EDI. Any company trying to build a pure-FHIR PA product was either violating HIPAA or had to maintain a FHIR-to-X12 bridge for the electronic transaction of record.

In 2024, alongside CMS-0057-F, CMS granted enforcement discretion allowing payers and providers to use an all-FHIR PA workflow in place of the X12 278. In effect, this waives the HIPAA mandate for PA specifically. The regulatory permission slip to skip the clearinghouse entirely is now issued. Any pure-FHIR infrastructure company that stands up a Da Vinci-compliant PAS pipeline can now legally operate as the full transaction rail for PA without needing to round-trip through X12 or a traditional clearinghouse. That is not an incremental improvement. That is the moment a whole category of legacy intermediaries becomes bypassable by regulation rather than by ambition.

This is why the Da Vinci PAS guide defines a FHIR-to-278 translation as optional for backwards compatibility rather than as a required bridge. Companies can run pure FHIR end to end. The clearinghouses know this, which is why their FHIR investments are accelerating. But by the time most of them ship FHIR-native product, several of their largest transaction categories will have already migrated.

CMS-0062-P and the Drug Rule

In April 2026 the Trump administration followed up with CMS-0062-P, a proposed rule that extends the same framework to prescription drugs. Impacted payers would have to support electronic PA for medications, adopt updated FHIR and NCPDP SCRIPT standards for drug transactions, and report their interoperability API endpoints and usage metrics back to CMS. The deadlines on the drug side are tighter. Medicaid plans would get 24 hours to respond to drug PA requests. ACA marketplace plans would get 72 hours for standard and 24 for expedited. The comment period runs until June 15, 2026, with proposed compliance in October 2027. Assuming it survives comment substantively intact, the drug rule locks in what the medical rule established: PA is now a federally regulated, API-delivered, time-bound transaction, and pharmacy is next.

The June 2025 AHIP Announcement and Why 257M Is the Real Number

The commercial sector, which covers most working-age Americans, is largely outside the direct scope of CMS-0057-F. The industry knows that if it does not move voluntarily, Congress or a future administration eventually will. On June 23, 2025, AHIP and the Blue Cross Blue Shield Association announced a joint voluntary commitment, built in partnership with HHS and CMS, designed to streamline PA across the commercial sector.

The headline number is the one that matters: the participating plans collectively cover roughly 257 million Americans. That includes UnitedHealthcare, Cigna, Aetna, Elevance Health, Humana, Centene, Kaiser Permanente, and the full Blue Cross Blue Shield federation. That roster is effectively every payer in the country that matters at scale. When a voluntary commitment covers 257 million lives, it stops being a PR gesture and becomes a de facto industry standard. It is also a flare to regulators and Congress that further rulemaking is unnecessary, which is the political function of such commitments generally.

The announcement laid out six specific commitments with staggered 2026 and 2027 effective dates. Honoring existing approvals for at least 90 days when a patient switches plans. Reducing the volume of PA requirements by identified service categories. Providing clear communication and transparency on denials and appeal rights. Expanding real-time responses across plans, culminating in 80 percent of electronic PA requests being addressed in real time by January 1, 2027. Ensuring continuity of care during transitions. And committing to specific measurement and public reporting of performance.

The April 2026 progress report was the first real read on whether the commitment was being executed. Participating plans reported eliminating 11 percent of prior authorizations across various medical services, which translated to 6.5 million fewer requests for patients. In Medicare Advantage the reduction was over 15 percent. BCBSA CEO Kim Keck re-committed the Blues specifically to the 80 percent real-time ePA target by January 1, 2027. Real time is the key phrase. Real time at the point of care is not a workflow improvement. It is an infrastructure requirement. It rules out batch, portal scraping, and any architecture that cannot guarantee sub-second response for the common cases. Hitting 80 percent real time on ePA forces FHIR-native backends, and a 257-million-life cohort of commercial payers is now collectively on the hook for that build by January 2027.

States Are Writing the SLA

While the federal and industry layers are setting the direction, state legislatures are the ones actually prescribing the operational constraints. The December 2025 NAIC Prior Authorization White Paper grouped state activity into four buckets: turnaround time requirements, gold carding, continuity of care protections, and AI guardrails. Each of them turns a discretionary administrative tool into a regulated SLA product, which is the exact moment when a workflow becomes a software market.

Washington State’s ESSHB 1357, passed in 2023, is the most technically prescriptive. It required health plans to build and maintain a FHIR-based PA API by January 1, 2025, with 72 hours for urgent and 7 days for standard turnaround. Miss the deadline and the request is automatically approved. Auto-approval on SLA miss is a bright line that effectively converts the SLA from aspirational into a liability-bearing legal obligation, because now a missed deadline has a measurable dollar cost. Nebraska’s LB 77 in 2025 did something similar, setting 72 hours for urgent and 7 days for non-urgent with auto-approval on miss, tightening urgent down to 48 hours starting in 2028.

Other states have piled on. Indiana’s SB 0480 requires 48 hours for urgent and 5 business days for non-urgent, and mandates electronic receipt of PA requests. Alaska’s HB 0144 requires 72 hours for standard and 24 hours for expedited. Michigan imposes 72 hours for urgent and 7 days for standard, with automatic approval on a missed deadline, using the same liability mechanism as Washington. Iowa’s HF 303 sets 48 hours for urgent and 10 days for non-urgent, and requires annual reporting to the state insurance commissioner. Illinois and Vermont have adopted 90-day continuity windows for plan switches, tracking the AHIP/BCBSA commitment. Colorado has passed rules allowing multi-year authorization validity for stable chronic regimens, which is operationally significant for specialty drug access. And California’s SB 363 goes in a different direction entirely by imposing denial-rate disclosure requirements and fines of up to $1 million per case where more than 50 percent of appeals are overturned. That last provision is effectively a statutory penalty for overly aggressive algorithmic denial, and it is going to be cited in every investor deck for an AI audit company for the next three years.

Gold Carding as a Data Problem in Disguise

Texas kicked off the gold carding trend with HB 3459 in 2021, which exempts physicians from PA for specific services if their approval rate over the previous 12 months is 90 percent or higher. The 2025 amendment, HB 3812, extended the evaluation window from six months to a full year and forced insurers to submit annual gold-card data reports to the Texas Department of Insurance. Arkansas followed with HB 1301 in 2025, applying gold carding at the group practice level.

Gold carding is usually sold as a patient-access mechanism, which it is, but operationally it is a data problem. To run a compliant gold card program at scale, a payer has to track provider-level approval rates by service category across rolling 12-month windows, with enough granularity to identify when a provider crosses the threshold and enough auditability to defend the calculation to a state regulator. That is the definition of a structured longitudinal dataset. Once a payer has that, the same infrastructure can be resold back to providers as a benchmarking tool, to employer groups as a network-performance metric, and to life sciences as a provider-segmentation input. Gold carding accidentally creates a provider-performance database as a regulatory byproduct.

The 90-Day Carryover Is a Payer-to-Payer API Problem

State laws are increasingly protecting patients from care disruptions when they switch plans. The AHIP and BCBSA commitments include a 90-day transition period where an existing PA must be honored for benefit-equivalent, in-network services. Virginia’s HB 736 from 2026 goes further, requiring that initial PAs remain in effect for at least six months and continued requests for at least 12 months. Nebraska’s LB 77 provides that approved PAs are valid for one year in most cases and can follow a patient for 60 days after a plan switch. Illinois and Vermont both now have statutory 90-day continuity windows. Colorado allows multi-year authorization validity for stable chronic regimens.

The mechanism that makes all of this work is the Payer-to-Payer API in CMS-0057-F. The statutory text of the carryover commitments presumes that an existing PA and its clinical documentation can physically move between payers in a timely, reliable, machine-readable way. That does not happen on its own. The Payer-to-Payer API is the rail: when a member opts in, the old payer ships up to five years of claims, encounters, USCDI clinical data, and PA history to the new payer in FHIR. Without that data flow, the 90-day honoring commitment reduces to the new payer taking the patient’s word for what was previously approved, which no payer will do at scale.

Think about what this actually requires in code. A PA approval is a state object. It has attributes: service, duration, clinical justification, approving clinician, expiration date, and associated documentation. It has to be portable across competing payers. It has to survive plan switches, network changes, and PBM transitions without losing integrity. Building the rails to securely transfer that state object between payers that are actively fighting for the same members is not a feature. It is a neutral intermediary layer, and no incumbent wants to be the one who builds it for the other side. That is a greenfield opportunity disguised as a compliance burden, with the Payer-to-Payer API as the underlying transport.

AI Guardrails and Where the Lawsuits Are Pointing

For anyone building AI for utilization management, the most important state-level trend is the wave of laws explicitly regulating algorithmic decision-making in PA. At least five states have enacted specific guardrails. Maryland’s HB0820, effective October 1, 2025, closely tracks California’s SB 1120 from 2024. Both require carriers, PBMs, and private review agents to ensure that any AI tool used in utilization management bases its coverage decisions on the enrollee’s individual medical and clinical history, not on group or demographic statistics. The Maryland law mandates at least quarterly reviews of any AI used in UM, requires carriers to report metrics on AI use in adverse decisions, and makes AI tools available for audit by the insurance commissioner. Violations can trigger misdemeanor charges, monetary penalties, and revocation of certificates. Nebraska’s LB 77 goes a step further and prohibits AI as the sole basis of a denial, requiring that adverse decisions be made by a physician. California’s SB 363 adds denial-rate disclosure and the million-dollar-per-case fine structure for high appeal-overturn rates.

These laws did not emerge in a vacuum. UnitedHealthcare’s nH Predict algorithm, used to set appropriate lengths of post-acute care for Medicare Advantage patients, has been the subject of class action litigation and congressional attention. Denial rates allegedly climbed from 10.9 percent in 2020 to 22.7 percent in 2022, a period that coincided with UnitedHealth’s acquisition of naviHealth, which built the tool. Plaintiffs claim the algorithm has a 90 percent error rate and routinely overrides physician recommendations. A federal judge in April 2026 ordered UnitedHealth to produce AI claim denial documents in discovery, which is going to be interesting to watch.

Cigna’s PXDX system, exposed in a 2023 ProPublica investigation, allegedly allowed medical directors to deny hundreds of thousands of claims per month without reviewing individual patient files by auto-flagging claims that did not match a list of pre-approved condition-procedure pairs. Reporting suggested a single medical director could push through more than 50 denials in seconds. Whether you view these tools as efficient triage or algorithmic rubber-stamping, the regulatory consensus has crystallized: AI can assist, but cannot be the decider. Any architecture that assumes otherwise is betting against the direction of every relevant legislature and most relevant plaintiffs’ firms.

The Da Vinci Stack in Plain English

The technical foundation for all of this is the HL7 Da Vinci Project, a private-sector standards initiative that brought payers, providers, and EHR vendors together to build FHIR-based implementation guides for value-based care workflows. CMS formally endorsed the Da Vinci PA guides as the basis for CMS-0057-F compliance, which means the Da Vinci PA suite is now effectively regulation by reference.

The ePA stack has three pieces. The first is Coverage Requirements Discovery, or CRD. When a clinician initiates an order or referral inside the EHR, a CRD call fires in the background to the patient’s payer and asks, in effect, does this service require PA for this member on this plan. The payer replies with a CDS Hooks card that drops into the clinician’s workflow and tells them before the order is locked in. Catching the PA requirement at the point of decision is the single highest-leverage intervention in the whole workflow, because it is the moment at which alternatives, documentation, or a different service choice are still possible.

The second piece is Documentation Templates and Rules, or DTR. Once PA is confirmed as needed, the DTR API pulls the payer’s specific clinical documentation requirements and business rules and presents them to the provider as a SMART on FHIR app or a structured questionnaire. DTR can also pre-populate answers by pulling from the patient’s existing clinical data in the EHR, which is where AI documentation synthesis has its biggest near-term footprint.

The third piece is Prior Authorization Support, or PAS. This is the submission layer. Once DTR has assembled the packet, PAS bundles the clinical data with the PA request using FHIR resources, submits it to the payer, and returns either a real-time decision or a tracking ID for pending cases. Historically the PAS guide included a FHIR-to-X12 278 mapping for backwards compatibility, but with the 2024 CMS enforcement discretion that mapping is optional rather than required. The response comes back as a structured FHIR resource, which means the EHR can auto-update the record and the workflow without human re-entry. When it works end to end, the whole thing looks less like prior authorization and more like a payment authorization on a credit card network, which is broadly the right mental model.

Where the Plumbing Actually Breaks

The architecture is clean on paper. Real life is messier. Even with the CMS waiver on X12, the X12 278 transaction still dominates current production UM environments and most clearinghouses are still overwhelmingly X12-based. The transitional reality is multi-hop architectures, latency budgets blown on translation, and error surfaces at every mapping boundary. Every translation is a place where bugs live.

The AMA numbers on the provider side are ugly. Only 23 percent of physicians say their EHR offers ePA for prescriptions, and 30 percent say the PA requirement information in their EHR is rarely or never accurate. Which means even where payers do stand up FHIR endpoints, the provider-side tooling to consume them is frequently absent, broken, or stale. Layer on BCBSA’s January 2026 admission that nearly half of PA requests are still submitted by fax or phone, and the picture is that fax machines and portal scraping are persistent because the alternative has not reliably arrived at the clinician’s desktop. The 2024 CAQH Index’s 35 percent electronic processing figure says the same thing from a different angle. And the 9 percent of surveyed orgs that can support a 2027-compliant ePA API says it from a third.

The clearinghouse layer is the other structural drag. Clearinghouses sit between providers and payers, routing transactions and translating formats. Most of the majors are optimizing their X12 infrastructure rather than rebuilding FHIR-native. That creates a real risk that the new FHIR rails get routed through legacy clearinghouse plumbing that neutralizes the whole latency premise of real-time adjudication. The CMS enforcement discretion theoretically lets anyone skip this layer entirely for PA. The question is who actually builds a credible alternative at payer scale fast enough to matter.

What AI Can and Cannot Do Here

AI is both the most interesting and the most dangerous layer in the new PA economy. On the provider side, AI genuinely shines in orchestration and synthesis. Give it a patient’s unstructured clinical notes, a payer’s DTR rule set, and a target service, and modern models can reliably identify the criteria, map documentation to them, and auto-populate the questionnaire. The clinician is still in the loop; the AI is doing the tedious evidence-assembly that a human has been doing with a highlighter and a prior fax for 20 years. That work is low-controversy, high-value, and straightforward to productize.

On the payer side, AI can route incoming requests intelligently, flag missing documentation, identify clear auto-approvals based on objective guideline adherence, and surface patterns that warrant clinician review. CMS itself has begun incorporating AI into review workflows, with an explicit requirement that licensed clinicians sign off on final decisions.

Where AI breaks is where vendors try to collapse clinical judgment into a model. The nH Predict and PXDX cases are not abstract: they are the templates for the next decade of litigation. The AMA survey found 61 percent of physicians are worried AI will increase denial rates, and there is no regulatory trajectory anywhere in the country in which AI gets to be the sole decider on an adverse determination. The durable business model is AI as triage and documentation, clinicians as deciders, with clean audit trails that prove which role each played. Anyone architecting the opposite will eventually be a discovery exhibit.

Provider-Side Orchestration as a Business

On the provider side, the immediate pain is unambiguous. Practices are spending $20 to $30 per PA transaction, and 40 percent of them have dedicated PA staff. The market for end-to-end orchestration is huge, underserved, and not yet consolidated.

The shape of the winning product is by now pretty clear. Sit on top of the EHR via SMART on FHIR or a direct integration. Use AI to ingest clinical notes and map them against payer-specific rules, using CRD and DTR where available and falling back to portal scraping or direct payer connectivity where they are not. Auto-package and submit the PAS request. Track state in real time. Close the loop back into the EHR with a structured result. The moat is coverage breadth. Any orchestration tool that only handles FHIR-native payers is a toy, because roughly half of PA volume is still fax or phone per BCBSA. The one that handles all payers and all service types, drugs included now that CMS-0062-P is bringing pharmacy PA into the electronic framework, is the one that wins the practice.

The competitive field on provider-side orchestration is already busy. Cohere Health, Rhyme, and Infinitus are among the better-known names. Myndshft, Infinx, Anterior, and Itiliti Health are each executing on meaningful slices of the workflow, with different specialty depths and different integration footprints. The category is not yet consolidated and specialty-specific orchestration (oncology, advanced imaging, MSK, high-cost drugs) still has whitespace where the generic horizontal tools tend to underperform.

The interesting second-order revenue model here is gold carding. An orchestration platform that consistently gets its providers to 90 percent approval rates across the service categories that matter is effectively shrinking the total addressable volume of PAs for those providers, which is an unusual and potentially disruptive product promise. It also makes the state-by-state complexity of gold card programs a moat, because a national tool that can track and administer gold card status across Texas, Arkansas, and any future state that enacts a program is meaningfully harder to build than it looks.

Payer-Side FHIR Middleware

Payers have a hard deadline and a hard problem. CMS-0057-F requires four FHIR APIs by January 1, 2027. Most legacy UM stacks were built on mainframes and X12 EDI and physically cannot hit sub-second response times. A 2026 Becker’s Payer survey found 28 percent of payers estimated spending $1 million to $5 million just on API implementation, which probably undercounts the true total cost of ownership once clinical policy digitization, integration testing, and ongoing SLA monitoring are priced in. The CAQH 9 percent readiness figure puts a number on the gap: the overwhelming majority of payers cannot actually ship to the rule as currently written.

That gap is the market for white-labeled FHIR middleware, or, as the pitch decks are now calling it, Prior Auth as a Service. The product ingests inbound PAS requests, runs them against digitized clinical guidelines (InterQual, MCG, internal policies), auto-approves the clear cases, and intelligently routes the gray ones to medical directors. The payer keeps control of clinical policy. The vendor handles the FHIR compliance, the latency engineering, and the public-reporting data layer. This is fundamentally a distributed systems problem, not a clinical one, which is why cloud-native engineering teams will likely outcompete legacy health IT vendors on this layer. The AHIP and BCBSA 80 percent real-time commitment is functionally a performance spec for the middleware category.

The infrastructure layer already has credible players, though none that has yet consolidated the market. Smile Digital Health (formerly Smile CDR) and Firely are the most prominent pure-play FHIR infrastructure vendors, with deep HL7 engineering benches and broad payer deployments. HealthEdge and CareEvolution are each building middleware-adjacent products aimed at the same 2027 deadline. None of them is an obvious default yet, which is unusual for a market with a hard deadline 14 months out.

The Portability Layer Nobody Owns Yet

The 90-day carryover from AHIP and BCBSA, combined with state rules like Nebraska’s 60-day portability, Virginia’s minimum duration requirements, and the Illinois and Vermont 90-day windows, creates a structural need for a neutral PA portability layer. The Payer-to-Payer API is the plumbing, but the plumbing needs an operator. When a member switches plans, the new payer has to receive the existing approvals and the clinical documentation that justified them in a machine-readable, standardized format, and the mechanism has to work across every combination of incumbent and recipient payer. The two payers are competitors. They have no existing data-sharing relationship. Neither wants to be the one to build the exchange that honors the other’s decisions at scale.

That is the definition of a neutral intermediary opportunity. The analogy is not perfect, but credit bureaus are instructive: a shared infrastructure that holds a history that any party in the ecosystem needs but none wants to operate individually, with a per-transaction fee model and a SaaS layer for access. A FHIR-native PA portability service that brokers Payer-to-Payer API calls, holds PA state objects, enforces data provenance, and exposes them to payers and providers on request would solve a compliance headache for the entire industry and would benefit from a strong regulatory flywheel as more states mandate continuity of care. The fact that nobody has obviously won this space yet, 14 months out from the 2027 deadlines, is mildly remarkable.

Compliance Tooling for the Algorithmic Audit Era

The Maryland and California AI laws, the parallel moves in Nebraska, and California’s SB 363 fine structure create a compliance surface that incumbent UM vendors are not structurally equipped to handle. Maryland alone requires quarterly audits of any AI used in UM, written policies and procedures for AI use, metrics reporting on AI involvement in adverse decisions, and the ability to make AI tools available for commissioner inspection. California layers on denial-rate disclosure and up to $1 million per case where appeals are overturned at rates above 50 percent. Any payer that has deployed AI into its UM stack now has a running compliance obligation that needs tooling.

There is a nascent market here for independent AI audit and compliance platforms. The product tests payer algorithms against clinical guidelines, monitors denial patterns for demographic disparity (the “unfair discrimination” standard in Maryland’s law), generates the reporting required by state insurance commissioners, and maintains the documentation needed to defend an algorithm under regulatory review. ONC’s HTI-1 algorithm transparency requirements, which require certified health IT developers to disclose information on predictive algorithms and assess them for fairness, appropriateness, validity, effectiveness, and safety, extend this demand to the vendor side.

The analog is SOC 2 or HITRUST, but for clinical algorithms. Payers will eventually want to be able to point at an external audit report the way they currently point at a SOC 2 Type 2. Someone is going to build that playbook and sell it to every UM vendor in the country.

PA-Aware Clinical Decision Support

One business model category that is hiding in plain sight inside the Da Vinci stack is PA-aware clinical decision support. The CRD API, by design, tells a clinician at order entry whether a service will require PA for a specific member on a specific plan. Flip that around and it is the raw material for a different kind of CDS: a tool that shows the clinician, in real time, which clinically equivalent alternative would be auto-approved, which would trigger PA, and which would likely be denied, before the order is committed.

This is a subtle reversal of the usual CDS flow. Traditional CDS surfaces clinical appropriateness. PA-aware CDS surfaces approvability as a first-class property of the order, alongside appropriateness. For service categories where multiple clinically equivalent options exist (imaging modalities, drug classes, step therapy alternatives, DME configurations), this tooling can eliminate a huge share of PA volume at the point of order entry by quietly steering clinicians toward the approvable option. The payer likes it because utilization conforms to guidelines without a denial fight. The provider likes it because the administrative burden disappears. The patient likes it because there is no delay. The CRD output is the input. Building this well requires deep integration with the EHR, strong payer rule coverage, and a UX that clinicians actually tolerate, which is a high bar, but the economic alignment across all three parties is unusually strong.

Patient-Facing PA Transparency and Appeal Tools

The Patient Access API in CMS-0057-F extends to PA status by 2027. That is a quietly important development for the patient financial experience category. Patients will be able to see, in real time through consumer-grade apps, which of their PAs are approved, which are denied, what the reasons for denial are, and where they stand in the appeal process. Historically that information has lived in payer portals that patients never log into, in letters that arrive after the fact, and in occasional calls to member services.

Once that data is accessible through a consumer-facing API, a new product category becomes possible: patient-facing PA transparency and appeal assistance tooling. Think of it as a mashup of patient financial experience software and legal tech. The product ingests a patient’s PA history through Patient Access, explains denials in plain language, automatically generates appeal letters with the clinical justification populated from the patient’s own clinical data, and tracks the appeal through to resolution. For high-cost services where PA denials are most consequential (specialty drugs, cancer care, rare disease therapies, complex surgical procedures), this is a genuinely novel category. It is also a natural adjunct to existing patient advocacy, price transparency, and financial navigation products. The CMS rule is the enabler; the market does not yet have a clear leader.

Specialty Benefit Manager Modernization

One area that is conspicuously absent from most PA economy analyses is the specialty benefit manager segment. Companies like Evolent, eviCore, Carelon, and Lumeris operate carved-out PA workflows for specific benefit categories (oncology, cardiology, radiology, musculoskeletal, post-acute) under delegated utilization management arrangements with payers. These pipelines are structurally fragmented, often built on bespoke legacy technology inherited from a decade of acquisitions, and not generally FHIR-native.

CMS-0057-F treats delegated UM vendors the same as the underlying payer for compliance purposes, which means the specialty benefit managers have the same January 2027 deadline as their payer clients. That creates two distinct business opportunities. One is a modernization play: building FHIR-native UM infrastructure specifically for the specialty benefit manager segment, which is operationally different from a horizontal payer middleware product because the rules, the specialties, and the clinical guidelines are narrower and deeper. The other is a consolidation play: a well-capitalized specialty benefit manager that modernizes its stack and then rolls up weaker competitors could meaningfully reshape the segment. Either way, this is a category that has been quietly overlooked relative to its PA transaction volume, and it deserves more attention than it gets.

The Dataset Is the Real Prize

Of all the layers in the PA economy, the one most chronically underpriced by entrepreneurs is the data layer. Once PA fully digitizes on FHIR rails, the exhaust is extraordinary. The CMS-0057-F public reporting requirements will produce, for the first time, a standardized, comparable, longitudinal dataset on payer PA behavior across Medicare Advantage, Medicaid, and ACA marketplace plans. CMS-0062-P extends the same framework to drugs. California’s SB 363 denial-rate disclosure adds state-level granularity. Over time this dataset captures payer decisioning patterns by service category and geography, denial rates by provider and specialty, provider performance against guidelines (the basis of gold carding), drug access patterns by formulary tier, appeal overturn rates at the level California fines on, and the correlation between PA denial rates and downstream clinical outcomes.

That dataset is monetizable in a dozen directions. Life sciences companies pay serious money to track market access for new drugs. Providers will pay to benchmark and optimize their gold card status. Payers will pay to benchmark their own UM efficiency against peers. Employers will pay to evaluate health plan performance on behalf of their beneficiaries. Even the plaintiffs’ bar will pay for pattern analysis, particularly in jurisdictions with California-style fine structures. The regulatory framework here is not just creating transparency. It is creating a structured public dataset that becomes the foundation for a new analytics category. The companies that aggregate, clean, and enrich this dataset first will have durable advantages that are hard to unwind once public reporting is established.

Incumbents, New Entrants, and Where the Whitespace Is

The current competitive map sorts roughly into five buckets. Legacy clearinghouses (Change Healthcare now under Optum, Availity, Waystar) own the X12 278 transaction layer and are slow on FHIR, partly because FHIR cannibalizes some of their existing economics and CMS just waived the regulatory requirement that kept them in the middle. EHR vendors (Epic, Oracle Health) are building CRD, DTR, and PAS into their platforms, but they are constrained by enterprise sales cycles and the sheer complexity of supporting thousands of payer-specific configurations inside a single product.

Specialty PA vendors on the provider side (Cohere Health, Rhyme, Infinitus, Myndshft, Infinx, Anterior, Itiliti Health) are executing well on AI orchestration but are not in the infrastructure layer. Payer infrastructure vendors (Smile Digital Health, Firely, HealthEdge, CareEvolution) are in the middleware race but have not consolidated the market. UM platform incumbents and specialty benefit managers (eviCore, Carelon, Evolent, Lumeris) hold payer relationships but tend to run on legacy stacks and have the most to lose from genuine disintermediation.

The whitespace is almost entirely in the infrastructure plane and the adjacent data and compliance layers. FHIR middleware for payer-side compliance. A neutral portability layer brokering Payer-to-Payer API transactions. Algorithmic audit and compliance tooling. PA-aware CDS. Patient-facing PA transparency and appeal tooling. Specialty benefit manager modernization. A standardized data products layer sitting on top of the CMS public reporting data. These are all platform businesses with genuine network effects, deep switching costs once the integrations are built, and a regulatory tailwind that is effectively a customer acquisition subsidy.

The other underappreciated angle is the drug side. CMS-0062-P specifically targets pharmacy PA, which is where patient harm from delay is often most acute (specialty drugs, oncology, rare disease therapies) and where the existing tooling is arguably even further behind the medical side. Surescripts dominates ePrescribing, but the ePA flow for drugs has been historically messy. A clean FHIR and NCPDP SCRIPT-native drug PA orchestration layer, tuned for specialty pharmacy workflows, is a highly defensible wedge if the rule finalizes on something like the proposed timeline.

Honest Risks and What Could Go Sideways

Any serious entrepreneur or investor in this space needs to hold five risks clearly in mind, because each of them has meaningful probability and each kills specific theses.

The first is payer foot-dragging. The history of payer compliance with federal interoperability rules is one of minimum viable effort. The plausible 2027 outcome is that a large share of payers ship thin FHIR veneers bolted on top of legacy UM stacks, technically satisfying the rule while delivering almost none of the real-time, sub-second experience the rule was designed to produce. Products that presume deep, high-quality FHIR implementation on day one will underperform. Products that assume a multi-year maturation curve for payer endpoints will be better positioned.

The second is dual-stack necessity. During the transition, which will last years, any provider-side product that only handles FHIR-native payers is non-viable, because half of PA volume is still fax or phone per BCBSA and 65 percent is still non-electronic per CAQH. The winning products will run FHIR where available and degrade gracefully to portal automation, fax, and phone where FHIR is absent. Architecting for dual-stack is a meaningful engineering investment that pure-FHIR purists will skip, to their commercial detriment.

The third is gold card complexity. Every state that enacts a gold card program writes its own rules: different thresholds, different evaluation windows, different service categories, different reporting obligations. A national tool that cannot handle the full compliance matrix across every gold-card state will get outcompeted by state-specific tools in its weakest jurisdictions. This is a classic compliance-as-moat dynamic, but only if the product genuinely gets it right.

The fourth is consolidation pressure. Clearinghouses and EHR vendors have strong incentives to buy FHIR middleware, audit tooling, and orchestration startups rather than build them. This is a positive outcome for founders but a material risk for investors who are underwriting independent platform trajectories. Strategic acquirers will pay for distribution and regulatory clocks; the timing of those deals will shape returns more than any individual product win.

The fifth is utilization rebound. This one is the most philosophically uncomfortable. If PA becomes frictionless (real-time, auto-approved for most requests, low administrative burden), payers may rationally expand the scope of services subject to PA rather than shrink it, because the cost of administering PA on a new service category drops to near zero. The end state may be more services subject to PA, not fewer, with the volume flowing through the new API rails. That is still a better patient experience than the status quo, but it is worth being honest: PA is being rebuilt, not eliminated. The rails are the market, and the rails are getting more capacity, not less. Anyone whose thesis depends on PA shrinking in aggregate is probably going to be disappointed.

Closing Thoughts

The Prior Authorization API Economy is not speculative. It is under active construction. Federal rules are laying the FHIR rails across four APIs. State laws are writing the SLA parameters and drawing the AI guardrails across at least a dozen jurisdictions. A voluntary commitment covering 257 million Americans is pulling the commercial sector onto the same standards without waiting for Congress. CMS has already waived the X12 mandate for PA, which is the quiet legal unlock that makes pure-FHIR infrastructure viable. And the documented dysfunction of the status quo (65 percent non-electronic, 9 percent of orgs actually ready, half by fax or phone, $15 billion of projected savings, 13 hours per physician per week, adverse events affecting nearly one in three physicians’ patient panels) makes the economic case for rebuild unambiguous.

The simple framing for entrepreneurs and investors is this. PA is becoming a programmable transaction, and programmable transactions always generate platforms. The companies that build the orchestration, the middleware, the portability, the audit tooling, the PA-aware CDS, the patient-facing transparency tools, the specialty benefit manager modernization, and the data products on top of the new FHIR rails will capture the value that currently evaporates in fax machines, peer-to-peer phone tag, and administrative overhead. Regulatory pressure is not the headwind in this market. It is the forcing function creating the market. Programmable medical necessity is a new category of health technology infrastructure, and 2027 is the year the rails get pressure-tested. The practical question is not whether to build here but which layer to build at: rails, trains, or stations. Each has a different capital profile, a different moat, and a different buyer, and each is wide open.​​​​​​​​​​​​​​​​

- Commercial payer tailwind: GLP-1 cost and utilization have broken the old formulary model, forcing employers, carriers, and PBMs to rebuild benefit design around eligibility, adherence, and outcomes logic rather than yes/no coverage.

- Cost anchor: KFF 2025 data shows 43% of firms with 5,000+ workers cover GLP-1s for weight loss (up from 28% in 2024), 59% report usage higher than expected, and 66% say the spend impact is significant. Mercer shows 77% of large employers say managing GLP-1 cost is extremely or very important for 2026.

- Employer-as-payer: 34% of firms covering GLP-1s now require dietitian, case mgmt, therapy, or lifestyle participation (up from 10% the year prior). Business Group on Health reports 79% of large employers have seen GLP-1 uptick with flat obesity-indication coverage and more utilization mgmt.

- Indication fragmentation: Wegovy added CV risk reduction (2024) and noncirrhotic MASH with F2-F3 fibrosis (2025); Zepbound got moderate-to-severe OSA in adults w/ obesity (Dec 2024). Each indication carries a different medical-necessity narrative and cost-offset story.

- Incumbent infrastructure already exists: Evernorth EncircleRx has 9M enrolled lives, offers a 15% cost cap or 3:1 savings guarantee, has saved plans ~$200M since 2024; Evernorth also added a $200 patient-copay cap on Wegovy and Zepbound in 2025. Optum Rx’s Weight Engage pairs GLP-1 access with obesity specialist navigation, coaching, and lifestyle programs. UHC Total Weight Support requires coaching engagement (Real Appeal Rx or WeightWatchers for Business) as a coverage gate.

- Manufacturer channel-war: Lilly Employer Connect (Mar 5, 2026) goes direct-to-employer at $449/dose Zepbound KwikPen with 15+ program administrators including GoodRx, Cost Plus Drugs, Teladoc, Calibrate, Form Health, 9amHealth, Waltz. Novo Nordisk is running a parallel DTE play with Waltz Health and 9amHealth (launched Jan 1, 2026 model).

- Persistence problem: Meta-regression data shows ~50% GLP-1 discontinuation within 1yr and ~60% of lost weight regained within 12 mo of cessation. Prime Therapeutics’ 3yr data cited by Mercer shows only 1-in-12 still on therapy after three years. That is the entire ROI problem in one stat.

- Build opportunity: utilization mgmt infra, outcomes-based contracting rails, indication-specific cardiometabolic programs (CV, OSA, MASH, perimenopause, prediabetes), adherence/tapering/discontinuation systems, and employer-side financing or subsidy products.

Table of contents

Why the old pharmacy benefit model cannot hold

What the KFF and Business Group data actually shows

How self-insured employers became micro-payers

The indication map: obesity, CV, OSA, MASH

Incumbent payer and PBM playbooks: EncircleRx, Weight Engage, Total Weight Support

Manufacturer counter-moves: Lilly Employer Connect and the Novo/Waltz direct channel

The persistence and discontinuation problem

Where the infrastructure and platform opportunities actually sit

Risks, skepticism, and things that could blow up the thesis

Closing take

Why the old pharmacy benefit model cannot hold

The thing worth saying up front is that GLP-1 economics are not just “expensive drug, same playbook.” They break the playbook. Pharmacy benefit managers were built to manage formularies of drugs where the eligible population is bounded, utilization is fairly predictable, and the plan sponsor mostly just needs a tier, a prior auth, and a rebate story. GLP-1s blow up every assumption in that stack. The eligible population is enormous (KFF estimates 36.2 million commercially insured adults have a BMI that would medically qualify them), the cost is recurring at roughly $1,000 to $1,200+ per month list, persistence is uncertain, and the indications keep expanding into territory that is harder to refuse (cardiovascular risk reduction, obstructive sleep apnea, noncirrhotic MASH). Put that all together and the plan sponsor cannot realistically answer a simple yes/no question about coverage anymore. What they have to answer is: which population, under what diagnostic threshold, through which channel, with what behavioral gate, at what subsidy level, for how long, and with what stop rule. That is a different product than a formulary. It is an operating model.

The KFF 2025 Employer Health Benefits Survey made the shape of the problem very concrete. Among firms with 5,000 or more workers, 43% cover GLP-1 agonists primarily for weight loss, up from 28% the prior year. Among the firms that do cover, 59% say use has been higher than expected and 66% say the impact on prescription spending has been significant. One employer told KFF the class went from its 32nd biggest drug spend line to its single biggest in one year. That is not a trend curve; that is a cliff. The behavioral reaction is exactly what anyone watching benefits design for a decade would predict: sponsors are not so much de-covering as re-covering with more logic bolted on.

What the KFF and Business Group data actually shows

Read more

This essay maps the best capitalized AI drug discovery companies as of April 2026 and separates their platforms by what they actually do under the hood. Key points covered:

- Top of the funding stack: Xaira ($1.3B disclosed), Eikon (~$1.5B incl. 2026 IPO), Isomorphic Labs ($600M external + ~$3B in Lilly/Novartis deal value), Recursion (post-Exscientia), insitro ($643M+), Iambic ($300M+), Genesis Therapeutics ($200M Series B), Chai ($225M+), Insilico ($500M+ private and a $293M HKEX IPO Dec 2025)

- Four real technical lanes, not one: structure foundation models, generative chemistry, phenomics and perturbational biology, translational prediction

- Industry papers worth reading: AlphaFold 3, Chai-1, Boltz-1/2, insitro POSH, Iambic Enchant, RFdiffusion family

- Academic papers worth reading: PoseBench, AI-guided competitive docking, Target ID review in Nat Rev Drug Disc, Cell gene-expression de novo design, Science active learning transcriptomics

- Clinical reality check: Insilico is the only one on the list with a Phase 2 readout in humans for a fully AI-discovered, AI-designed asset (rentosertib in IPF)

- Where the moat is going: not any single layer, more the integration of proprietary perturbational data, generative models, automated wet labs, and clinical translation infrastructure

Table of contents

Why the funding question has two answers

The capital stack as of April 2026

The four technical lanes and why blurring them is lazy

Isomorphic vs Chai vs Boltz, the structure foundation lane

insitro and Recursion, the phenomics lane

Iambic and Genesis, the translational and generative chem lane

Insilico, the only one with a Phase 2 human readout

The papers that actually matter

What the moat is becoming

Why the funding question has two answers

There are two clean ways to answer who has raised the most in AI drug discovery, and they give different rankings, so anyone who lumps them together is mostly trying to sell something. Method one is largest single disclosed financing event. Method two is largest disclosed total capital raised over the life of the company. Method one rewards splashy launches and IPOs. Method two rewards persistence, quiet follow-ons, and being old enough to have stacked rounds. The most useful version of the answer is to keep them separate, then layer on a third lens, which is the value of the pharma deal book, since for some of these companies that money is functionally part of the runway even if it is technically contingent on milestones.

The capital stack as of April 2026

By largest single financing event, the top of the heap is still Xaira launching in April 2024 with more than $1B of committed capital, Isomorphic raising $600M in its first external round in March 2025, Exscientia closing $510.4M of aggregate IPO financing back in 2021 (now folded into Recursion), Recursion at $436.4M in its 2021 IPO with substantial follow-ons since, and Eikon at $350.7M in a Series D in February 2025 followed by a $381.2M IPO in February 2026.

By largest disclosed total, the picture shifts. Eikon now sits around $1.5B if you add the post-IPO capital to the $1.1B+ it had said it raised privately by 2025. Xaira has quietly grown to roughly $1.3B in total disclosed funding, not the $1B headline number that still gets cited everywhere. Isomorphic is $600M of external financing plus whatever Alphabet has been pouring in internally for years before the external round, plus a deal book with Lilly and Novartis worth nearly $3B in upfront and milestone value, with Novartis having expanded the partnership in February 2025 to add up to three more programs. insitro is at least $643M from its $100M+ Series A, $143M Series B, and $400M Series C. Iambic is at $300M+ across a $53M Series A, a $150M+ Series B, and an oversubscribed $100M+ raise in late 2025. Genesis Therapeutics, which often gets left off these lists for some reason, is at roughly $280M total after its $200M Series B co-led by Andreessen Horowitz. Chai is at $225M+ after its December 2025 Series B. And Insilico, the only one in this group that has actually tapped public equity markets, raised about $293M ($2.277B HKD) in its December 30, 2025 Hong Kong IPO on top of more than $500M raised privately, which puts it somewhere around $800M total disclosed.

So the right shortlist of best-capitalized AI-native or AI-centric drug discovery players to watch in 2026, in roughly the right order, is Eikon, Xaira, Isomorphic, Recursion (with the absorbed Exscientia capital), insitro, Insilico, Iambic, Genesis, and Chai. That ordering changes a bit depending on whether you count the Isomorphic deal book as capital, whether you count public-market dollars at par with private, and whether you treat Recursion plus Exscientia as one entity or two. None of those framing choices is wrong. They are just different.

The four technical lanes and why blurring them is lazy

The single most underrated point about AI drug discovery in 2026 is that it is not one category anymore. It is at least four real technical lanes, and the model classes, the data moats, the validation strategies, and the failure modes are pretty different across them.

Lane one is structure prediction and biomolecular foundation models. This is AlphaFold 3, Chai-1, Boltz-1, Boltz-2. The bet is that if you can model proteins, nucleic acids, ligands, ions, and modified residues all at once, much more of medicinal chemistry can move in silico. Lane two is generative chemistry, which is about proposing actual molecules with desired properties, often through diffusion models, language models for molecules, or graph neural nets. Lane three is phenomics and perturbational biology, which is about generating massive amounts of cellular data and learning representations over biological state, rather than over atomic geometry. Lane four is translational prediction, which is the layer trying to predict whether a preclinical candidate will actually survive ADME, tox, PK, and human trials. Most slide decks blur these. They should not be blurred. A company optimized for lane one will not necessarily fix the problems in lane four, and vice versa.

Isomorphic vs Chai vs Boltz, the structure foundation lane

Isomorphic Labs is the most structure-centric of the top tier. Its bet is essentially that if you can model biomolecular complexes well enough, structure-based drug design becomes radically more productive. AlphaFold 3 is the technical anchor, and its core contribution is a diffusion-based architecture for joint complex prediction, which is a very different philosophy from the older AlphaFold 2 design and a totally different philosophy from classic QSAR or phenotypic screening. The commercial proof is the Lilly and Novartis deals signed in early 2024, which together had roughly $3B in upfront and milestone value, plus the Novartis expansion in February 2025 adding more programs. Then there is the not-so-small fact that Demis Hassabis and John Jumper picked up the 2024 Nobel in Chemistry, which is the kind of institutional validation no other company on this list has.

Chai is closest to Isomorphic in spirit but very different in posture. Chai-1 is also a multimodal foundation model for biomolecular structure prediction, but it is openly accessible for non-commercial use, can run in single-sequence mode without multiple sequence alignments while preserving most of its performance, and can optionally be prompted with experimental restraints. The most underdiscussed differentiator between these two is not raw model quality but licensing and posture. Isomorphic gates AlphaFold 3 for commercial use pretty tightly, which has pushed a meaningful chunk of industry computational chemistry and biotech R&D toward Chai, Boltz, and the open lane. That is a moat question, not a quality question, and it is the kind of thing that will matter more than benchmark scores over the next few years.

Boltz, out of MIT, deserves more attention than it usually gets. Boltz-1 and the more recent Boltz-2 are fully open weights and training code, which neither AlphaFold 3 nor Chai-1 are. For academic groups, smaller biotechs, and any team that needs to fine-tune on its own proprietary data without sending that data into someone else’s API, Boltz is increasingly the default. Boltz-2 in particular has made meaningful gains on affinity prediction, which has historically been the place where structure foundation models embarrass themselves. A useful frame is that Isomorphic owns the lab, Chai owns the playground, and Boltz owns the open commons. All three matter.

The bigger meta point about the structure lane is that being able to predict structures is now table stakes. The field has slowly figured out that protein-ligand geometry alone is not the actual bottleneck to successful programs. Translation, ADME, tox, PK, manufacturability, patient selection, those are the bottlenecks. Structure prediction is necessary, not sufficient.

insitro and Recursion, the phenomics lane

insitro is much less about structure prediction and much more about building a data engine around human biology. The official positioning is integration of in vitro cellular data from its own labs with human clinical data, genetics, and machine learning. The CellPaint-POSH paper published in Nature Communications in 2025 makes the technical nuance much clearer. POSH combines pooled CRISPR perturbation, Cell Painting, and self-supervised representation learning to infer gene function and disease biology at scale. So insitro’s comparative advantage is upstream and translational. It is trying to learn disease state and intervention biology from richer human-relevant data, rather than guessing whether a small molecule will fit a binding pocket. Whether that bet pays off depends on whether the resulting models generalize beyond the cell types and perturbations in the training set, which is honestly still an open question for the entire phenomics field.

Recursion is the clearest phenomics-first player and has been since well before the rest of the field caught on. Its platform language is about Maps of Biology and Chemistry, high-content perturbational data, and large proprietary biological and chemical datasets. The bet is similar in spirit to insitro but the scale and the wet lab automation are different. Recursion has been generating petabyte-scale image data for a long time and the data moat is real. The harder question is what to do with all of it. Recursion absorbed Exscientia in November 2024, which gave it a generative chemistry leg the original platform did not really have. The industrial logic of that deal is sound. The integration story has been bumpy in practice, with program shedding and headcount changes through 2025, and the combined entity has not yet shown the world the integrated end-to-end story it promised at deal announcement. The capital base is still impressive, the platform is still differentiated, but there is some operational risk that gets glossed over in the bull case.

The fair summary on the phenomics lane is that the data moat is durable, the model story is improving fast, but the translation from cellular phenotype to actual clinical benefit remains the hardest leap, and nobody has fully cracked it yet.

Iambic and Genesis, the translational and generative chem lane

Iambic is aiming at a different bottleneck than the structure folks or the phenomics folks. Enchant is positioned as a multimodal transformer trained across many data sources to predict key clinical properties from mostly preclinical information, with the explicit claim that it helps bridge the data wall between discovery-stage and human-stage R&D. So Iambic is less about target ID, less about protein-ligand pose, and more about translational risk reduction layered on top of medicinal chemistry and candidate selection. In plain terms, Isomorphic and Chai are asking what binds and how, insitro and Recursion are asking what biology matters and in whom, and Iambic is asking which candidates are most likely to survive the trip from preclinical to clinic. That is a real and underserved bottleneck. The honest caveat is that Enchant is still presented primarily through company materials and press coverage rather than through a peer-reviewed flagship methods paper, so the external validation is thinner than the structure prediction work.

Genesis Therapeutics often gets left off these lists, which is strange because its $200M Series B co-led by Andreessen Horowitz puts it in the same neighborhood as Iambic, and its GEMS platform is a meaningfully different technical bet. Genesis leans on graph neural networks for molecular property prediction, with a focus on potency, selectivity, and ADME prediction in the design stage, rather than on structure foundation models or pure phenomics. The closest analog is probably Iambic in terms of where in the pipeline it is trying to add value, but the model architecture is different, and the company is older, with a longer track record of internal asset development. For investors who want exposure to the design and optimization layer specifically, Genesis is closer to the front of the field than its press footprint suggests.

Insilico, the only one with a Phase 2 human readout

Insilico Medicine is the most product-shaped of the AI-native discovery companies, and it is the only one on this list with a clinically validated AI-discovered asset. The Pharma.AI platform is split across PandaOmics for target discovery and Chemistry42 for molecule generation and optimization, and Chemistry42 in particular combines generative AI with physics-based methods, which is a more nuanced story than the usual “language model for molecules” pitch. The asset that matters here is rentosertib, also known as ISM001-055, a TNIK inhibitor for idiopathic pulmonary fibrosis. The Phase 2a results were published in Nature Medicine in June 2025, with further studies in kidney fibrosis and an inhaled IPF formulation planned for 2026. There is also ISM5411, a gut-restricted PHD1/2 inhibitor for inflammatory bowel disease that has completed Phase 1.

The other very real thing about Insilico is that it is the only one on this list that has actually tapped public equity markets. Insilico raised about $293M in its December 30, 2025 Hong Kong Stock Exchange IPO, becoming the first AI-driven biotech to list on the HKEX Main Board under Chapter 8.05 listing rules. That offering was the largest biotech IPO in Hong Kong in 2025 by funds raised, and the cornerstone book included Lilly, Tencent, Temasek, Schroders, UBS AM, Oaktree, E Fund, and Taikang Life Insurance. Lilly and Tencent each subscribed for the first time as cornerstone investors in a biotechnology company, which is a small but meaningful signal about cross-industry conviction in AI-native R&D. Combined with more than $500M raised privately across rounds backed by Warburg Pincus, Qiming, WuXi AppTec, B Capital, Prosperity7, OrbiMed, Deerfield, and others, Insilico is now sitting on a roughly $800M total disclosed capital base, with revenue (yes, real revenue) of $85.8M for 2024 and a net loss of $17.4M, per the prospectus.

Whatever someone thinks of any individual platform claim, the asymmetry is real. Insilico is the only company in this group that can point to a Phase 2 readout in humans for a fully AI-discovered, AI-designed asset. Everyone else is still arguing about model architectures and benchmark scores. Clinical data is the only real moat in this industry over the long run, and Insilico is the first to get there at meaningful scale.

The papers that actually matter

For the industry-led reading list, four papers are unavoidable. AlphaFold 3, “Accurate structure prediction of biomolecular interactions with AlphaFold 3,” published in Nature in 2024, is the core Isomorphic and Google DeepMind paper extending structure prediction to joint complexes across proteins, nucleic acids, small molecules, ions, and modified residues. Chai-1: Decoding the molecular interactions of life, published as a 2024 technical report and bioRxiv preprint, is Chai Discovery’s main structure prediction paper and the cleanest comparison point to AlphaFold 3 for anyone who wants to actually use a model commercially without negotiating with Alphabet. Boltz-1 and Boltz-2 from MIT belong on the same shelf for anyone who wants the open weights and training code path. The third is “A pooled Cell Painting CRISPR screening platform enables de novo inference of gene function” from insitro, published in Nature Communications in 2025, which is the strongest recent insitro methods paper and the cleanest articulation of the phenomics-plus-CRISPR-plus-self-supervised-learning thesis. The fourth is the Iambic Enchant white paper, which is not a peer-reviewed journal article and should be read with that caveat, but is still the clearest articulation of the translational prediction lane right now.

The RFdiffusion and RFantibody work coming out of David Baker’s lab at the University of Washington is also unavoidable for anyone trying to understand where Xaira comes from intellectually. Baker is a Xaira co-founder and the researchers who built RFdiffusion and RFantibody in his lab are now part of Xaira. Anyone serious about generative biologics in the next two years should be reading Baker lab output continuously.

For the academia-led or academia-heavy reading, the most useful set is more about evaluation, target ID, and closed-loop discovery than about splashy company launches. The 2026 Nature Machine Intelligence paper “Assessing the potential of deep learning for protein-ligand docking” is one of the most useful reality-check papers in the field. It introduces PoseBench and shows that co-folding methods can beat older docking baselines, but also that models still struggle with novel binding poses, multiligand settings, and chemical specificity.

The 2026 npj Drug Discovery paper “AI-guided competitive docking for virtual screening and compound efficacy prediction” is notable because it pushes beyond pose prediction toward rank-ordering active vs inactive compounds and using pairwise competitive docking for prioritization.

The 2026 Nature Reviews Drug Discovery review “Target identification and assessment in the era of AI” is probably the cleanest recent synthesis if the interest is upstream target discovery rather than only structure prediction.

The 2026 Cell paper “Deep-learning-based de novo discovery and design of therapeutic molecules guided by gene-expression signatures” points to a transcriptomics-driven route for molecule generation rather than pure structure-first design.

And the 2025 Science paper “Active learning framework leveraging transcriptomics identifies modulators of disease phenotypes” matters because it moves the conversation toward closed-loop wet-lab learning systems instead of static benchmark chasing.

If a reader only reads one company-led paper and one academic paper, the highest signal pair is probably AlphaFold 3 from Nature 2024 plus the PoseBench paper from Nature Machine Intelligence 2026. AlphaFold 3 is the unlock. PoseBench is the cold shower.

What the moat is becoming

The capital is still flowing most aggressively into firms trying to own the full stack. Proprietary data generation, multimodal foundation models, generative chemistry, automated wet labs, translational prediction, and at least some path to internal asset creation. The paper frontier, meanwhile, is shifting from “can we predict structures” toward “can we rank actives, generalize to new chemistry, incorporate phenotypes, reduce downstream attrition, and run closed-loop experiments.” That is the right shift. Structure prediction was the unlock around 2020 to 2024. It is not the full moat in 2026.

The blunt version is this. Isomorphic and Chai are leading the structure-foundation-model lane. Boltz is leading the open structure-foundation lane. insitro and Recursion are leading the biology-data and phenomics lane. Iambic and Genesis are leading the translational and generative chem lane. Insilico is the most modular, most productized, and the only one with a Phase 2 human readout. Xaira is the wildcard with the deepest capital and the strongest generative biologics talent density. Eikon is the new public-market entrant with one of the largest total capital bases in the field. Recursion plus Exscientia is the most ambitious integration story but with real operational risk in the near term.

The harder truth underneath all of this is that no single technical layer is the moat anymore. The moat is becoming the integration of proprietary perturbational data, generative models, automated wet labs, and clinical translation infrastructure, with patient-relevant data as the actual scarce input. That is exactly why the well-capitalized players are all trying to own the full stack, and exactly why the question of who has the best paper is becoming less predictive of who will have the best platform than it was three years ago. Clinical assets in humans are now the differentiating column on any honest market map. Right now, only one company in this group has a real one. Everyone else is trying to catch up to that fact.​​​​​​​​​​​​​​​​

- Focus: Late 2025 and early 2026 earnings calls across major payers and hospital operators

- Core idea: margins are not disappearing, they are moving across segments

- Key tensions: utilization vs pricing, insurance vs services, volume vs acuity

- Critical signals: Medicare Advantage pullback, PBM revenue quality, hospital revenue cycle strain -

- Who is winning: diversified platforms with services leverage

- Who is exposed: pure-play MA insurers and lower-scale hospital operators

Table of contents

- The setup: utilization did not normalize, it reset

- Insurance margins: the illusion of recovery

- Medicare Advantage: from growth engine to controlled burn

- Services businesses: where the margin actually went

- Hospitals: strong volumes, stubborn economics

- Revenue cycle: the silent margin battlefield

- Where narratives conflict across the stack

- What management teams are signaling vs what they are avoiding

- What this means for operators, builders, and investors

The setup: utilization did not normalize, it reset

The single most important thing buried across these calls, and it really is buried because nobody wants to say it out loud, is that utilization did not revert. It stepped up and stayed there. That sounds obvious in retrospect, except the entire industry spent roughly eighteen months telling itself a different story. The official narrative through most of 2023 and well into 2024 was that the senior utilization spike was a transitory unwind of deferred care, a kind of pig moving through the python, and once it cleared things would settle back into the old trend line. That narrative is gone now. It got quietly retired somewhere between the mid 2024 guidance cuts and the late 2025 calls, and nobody held a funeral.

What replaced it is messier and a lot less comforting for anyone who priced risk based on the old assumptions. The senior population is older, sicker, and more engaged with the system than the actuarial models expected. Chronic disease burden is not receding. Cardiovascular procedures, orthopedic interventions across both inpatient and outpatient settings, and specialty drug utilization are all running at levels that make 2019 through 2022 pricing decisions look like they were made on a different planet. Part of this is demographic, with the leading edge of the boomer cohort now well into the high utilization zone. Part of it is behavioral, with supplemental benefit designs from the Medicare Advantage boom years having trained a generation of seniors to actually use their coverage. And part of it is pharmaceutical, with GLP-1 adjacent prescribing patterns and specialty pipeline launches pulling spend forward in ways that underwriting did not fully anticipate.

The earnings language tracks this shift if you read it with the right ear. The word normalization has mostly disappeared. What you hear now is calibration, recalibration, repricing, discipline, and the ever popular operating rigor. That is not accidental. Calibration implies the system is adjusting to a new steady state. Normalization implied the old steady state was coming back. Those are very different concepts and the word swap is doing real work.

The practical implication is that every business model in the stack that was sized for 2019 utilization economics has been quietly rebuilt, or is in the process of being rebuilt. That rebuild is the actual story of the last four quarters, and most of what follows is really just variations on it.

Insurance margins: the illusion of recovery

At a headline level the payer numbers have stopped getting worse. MLRs are no longer expanding at the same pace. Some carriers are guiding to modest year over year improvement. If you squint, it looks like stabilization, maybe even the early innings of recovery. That is the surface.

Underneath it is not really recovery. It is a repricing exercise catching up to a cost base that shifted two years ago, combined with benefit design trims and network tightening that took out some of the worst unit economics. The underlying cost structure did not get better. The pricing got closer to the cost.

The cleanest illustration of where this leaves things sits inside CVS, where the insurance segment has produced quarterly losses even while the enterprise as a whole still generates billions in operating income. That is the whole story in one line. The underwriting engine is not the profit engine right now. It is being carried by everything around it. The insurance book is still functional, still servicing millions of lives, still generating massive revenue, but the margin contribution has effectively been redirected. Management can frame that as strategic integration, and they do, but the accounting reality is that one segment is subsidizing another.

Cigna shows a variation on the same pattern with different geometry. The stub healthcare segment, once adjustments for the Medicare divestiture are baked in, is stable to modestly growing. The scale and the growth both sit in Evernorth. But inside Evernorth the split between top line and bottom line is where the interesting tension lives. Revenue is expanding very quickly, driven by pharmacy volume, specialty pipeline, and care services. Operating income is growing too, but not at the same rate in the PBM core. That gap is meaningful. It tells you that some of the growth is lower quality than the revenue line suggests. Spread compression in traditional PBM economics is real and ongoing, even as specialty and care services do the heavy lifting on incremental margin.

UnitedHealth looks cleaner on the surface mostly because Optum is enormous and the segment reporting structure allows the services strength to mask the insurance pressure. The insurance pressure is still there. It is just being absorbed inside a larger system. The 2024 medical cost pressure stories, the 2025 guidance revisions, and the ongoing commentary around the individual senior lives with higher than expected cost trend all point to the same underlying dynamic the rest of the sector is dealing with. Optum is not making that dynamic go away. It is providing enough offsetting profit contribution that the consolidated numbers stay investor friendly.

Elevance sits in a somewhat similar place, with Carelon doing more of the work each quarter. Humana, because the services arm is smaller relative to the insurance book, shows the pressure more rawly. The variance across carriers in how painful the current environment looks is largely a function of how much services leverage is sitting next to the insurance book. That is not a coincidence. That is the structural story.

The industry level takeaway is simple to state and slightly awkward to live with. Insurance margins did not magically recover on the back of some endogenous improvement in the business. They stabilized because pricing caught up, benefits were trimmed, networks were tightened, acquisition costs were pulled back, and supplemental design was rationalized. The cost structure underneath is not fundamentally different than it was when MLRs were blowing out. It just has a bigger revenue number on top of it.

Medicare Advantage: from growth engine to controlled burn

For most of the last decade Medicare Advantage was the easiest growth story anywhere in healthcare. Enrollment compounded at rates that would make a SaaS founder jealous, risk adjustment methodology supported margin, supplemental benefit escalation drove market share wars, and public markets rewarded whoever could show the fastest lives growth. That era is visibly over. Not winding down. Over.

The earnings language now leans into discipline, which is the polite industry word for walking away from members. Plans are exiting geographies, trimming or eliminating supplemental benefits that drove prior enrollment gains, pulling back on broker channel aggression, and being much more selective about which segments of the senior population they want to grow in. The 2026 plan year filings, read in aggregate, show benefit reductions that would have been unthinkable three years ago. Dental, vision, OTC allowances, transportation, grocery cards, the whole supplemental stack that defined the competitive dynamic in 2019 through 2022 is being scaled back or eliminated across large swaths of the market.

Humana is the most transparent about this because it has to be. As the most MA concentrated of the major publicly traded insurers, the pressure shows up in its numbers without anywhere to hide. The messaging centers on recalibration and return to margin, but the actions are sharper than the words. Benefit designs are being cut. Growth is being traded explicitly for per member profitability. The company is basically telling the market it would rather shrink into a more profitable book than grow into a less profitable one. That is the right strategy. It is also a complete inversion of the playbook that drove valuation for a decade.

The variance across players in how they can absorb this shift is where the two speed market really shows up. A company with a large services arm can tolerate compressed insurance margin because it is monetizing the same lives through pharmacy, specialty distribution, care delivery, behavioral, and analytics. The insurance book becomes a customer acquisition channel for a broader platform. A pure play MA insurer does not have that option. Its insurance margin is its margin. When that compresses, everything compresses. That is why the smaller and more concentrated MA names have had such a brutal stretch relative to the diversified platforms, even when the underlying medical cost trend they are fighting is roughly similar.

Risk adjustment methodology is the other overhang. The V28 transition phase in, combined with increased audit activity and the ongoing debate about coding intensity, is putting downward pressure on risk scores at exactly the moment cost trend is elevated. Plans that built their margin on aggressive coding are getting squeezed from both sides, with costs going up and risk adjusted revenue going down. That is not a temporary mismatch. That is a structural reset of the economics of the product.

The part none of the calls really address head on is what this means for the supplemental benefit arms race as a competitive dynamic. If everyone is trimming benefits at roughly the same time, the relative competitive position does not change that much. The senior who was getting a three hundred dollar OTC card is now getting a hundred and fifty, but so is everyone else in the market. The question is whether enrollment behavior responds to the absolute level of benefits or the relative level. Early signals suggest absolute matters more than the industry wants to admit, which would imply disenrollment pressure as seniors shop around looking for the benefit levels they got used to. That shows up in the 2026 AEP data, and it is a tension that is going to define the next twelve to eighteen months.

Services businesses: where the margin actually went

If there is one through line across every major payer call, it is that services are doing the work. Optum, Evernorth, and the CVS Health Services segment are not diversification anymore. They are the core earnings engines. The margin that used to sit in insurance has been relocated one layer up in the stack, into the services businesses that sit adjacent to or inside the same enterprise.

Evernorth is worth walking through because its segment reporting is relatively clean and the dynamics are visible. Top line growth is being driven by pharmacy volume, with specialty continuing to be the fastest growing component, and by care services including the Express Scripts and Evernorth Care businesses. Operating income growth is positive but materially slower than revenue growth in the PBM core. That gap is spread compression. Pass through pricing models, transparent rebate arrangements, and ongoing employer pressure on PBM economics are all grinding at the traditional margin structure. Specialty pharmacy and care services are carrying a disproportionate share of incremental operating income, which is where the higher quality growth actually is.

CVS Health Services shows a similar shape with more noise. The segment is highly profitable on an adjusted basis. It is also where the significant goodwill impairment charges tied to care delivery assets have landed, most visibly on the Oak Street side. That is the part that makes the vertical integration narrative complicated. The strategic logic, which is that owning primary care for seniors gives the insurance arm more control over cost and quality, is sound in theory. The economics of acquiring those assets at 2021 valuations and integrating them into a much larger system have been mixed. Some of the acquired capital is performing. Some of it is being written down. When you read the adjusted numbers you see the performing part. When you read the GAAP numbers and the impairment disclosures, you see both.

The distinction matters because it changes how to think about the returns on vertical integration strategy at the sector level. If the services margin that is replacing insurance margin is partially financed by writing down the assets that were supposed to generate it, the net economics are softer than the adjusted numbers suggest. That does not make the strategy wrong. It makes the strategy more expensive than the adjusted framing implies, and it raises the bar for whether the promised long term synergy benefits materialize.

Optum is the benchmark here because it has operated at scale the longest. Optum Health, Optum Rx, and Optum Insight each show different margin profiles and different growth trajectories. Optum Rx looks a lot like Evernorth on the PBM side, with pharmacy volume growth outpacing operating income growth. Optum Health is a mixed bag, with value based care arrangements performing unevenly across geographies and populations. Optum Insight is the quietly interesting one, because the technology and revenue cycle component has relatively clean high margin growth that does not carry the same cyclical exposure as the insurance or care delivery components. That is where the infrastructure tax on the rest of the system shows up, and it is showing up reliably.

The industry level point is that the services wrapper around the insurance book is not a hedge. It is where the margin is. But not all services are equal. PBM core economics are compressing. Specialty pharmacy economics are holding up but under ongoing pressure. Care delivery economics are mixed and carry real integration risk. Data and technology services are the highest quality component, with the caveat that they are smaller in absolute dollars. Reading the services story as a monolith misses the texture. The texture is what matters.

Hospitals: strong volumes, stubborn economics

On the provider side the first read of the data looks positive. Volumes are up. Acuity is up. Revenue per adjusted admission is up. Same facility revenue growth is running at rates that would historically drive meaningful margin expansion. The margin expansion has not really shown up, or has shown up much less than the top line would suggest.

The reason is a cost base that reset in 2021 and 2022 and has not reset back. Contract labor is well off its peak, which gets called out on every call as a tailwind, but base wages stepped up permanently. Nursing compensation, tech compensation, and the compensation structure for the scarce clinical roles are all at levels that are not reverting. Supply costs, particularly for implants and specialty pharmaceuticals used in the inpatient and outpatient settings, are elevated and sticky. Professional fees for hospital based physician services, especially anesthesia and emergency medicine, have stepped up as the staffing companies in those spaces work through their own economic issues.

HCA, because it is the largest and most operationally sophisticated of the for profit hospital operators, shows the cleanest version of this dynamic. Same facility revenue growth is strong, acuity is favorable, and management commentary is generally constructive. Margins are improving but the rate of improvement is slower than the top line growth would historically predict. That gap is the cost base.

Tenet shows a slightly different picture because of USPI. The ambulatory surgery center portfolio is genuinely high margin and growing, and it pulls the consolidated margin profile up in a way that masks some of the hospital side pressure. Stripping USPI out, the pure hospital margin story looks a lot more like Community Health Systems and HCA.

Community Health Systems is worth calling out because the numbers are unvarnished in a way that is useful. Same store revenue growth has been positive, but admissions have been flat to slightly down in several recent quarters. That tells you that pricing, case mix, and supplemental payment programs are doing most of the work. It is not bad. It is lower quality than volume driven growth, and it depends on the durability of the supplemental payment structures, which is not guaranteed.

The supplemental payment dynamic is its own topic and does not get enough attention in the calls. State directed payment programs, Medicaid supplemental arrangements, and various 1115 waiver structures are material contributors to reported margin for a lot of hospital systems, particularly those with higher Medicaid and uninsured exposure. Those programs get renewed or restructured on state level timelines, and the federal posture toward them has been shifting. A material change in the supplemental payment environment would move provider margin noticeably. The calls mostly treat this as background noise, which it is not.

Payer mix is the other thing quietly eating into the volume story. The continued shift from commercial to Medicare, driven by demographics and by employer plan changes, is compressing average reimbursement per case even as acuity and volume both trend up. Medicare Advantage now represents a majority of Medicare eligible lives in many markets, which means hospital reimbursement is increasingly set by MA contract rates rather than traditional Medicare. Those rates vary by plan and by contract vintage, and the tension between hospitals and MA plans over reimbursement, prior authorization, and claims adjudication is visible in the contracting commentary across calls. Several large health systems have publicly exited MA contracts with specific plans, which is a new dynamic and worth watching.

The hospital margin story right now is an operational grind. Incremental improvement is possible and is happening. The idea of snapping back to 2019 margins at the sector level is not supported by anything in these calls.

Revenue cycle: the silent margin battlefield

Almost every provider call touches revenue cycle, but usually as a side note rather than a central theme. That framing is wrong. Revenue cycle is where a large share of the unresolved margin battle is actually being fought.

Denial rates are up, and the composition of denials is shifting toward more clinically complex reasons that take longer to overturn. Prior authorization requirements are expanding across both commercial and Medicare Advantage books, and the administrative friction is rising in ways that are not fully captured in any single line item. Collections are getting harder as high deductible plan penetration continues and patient out of pocket obligation grows. Average days in accounts receivable have drifted up across most of the large publicly traded systems, even as they have invested heavily in revenue cycle technology and offshoring.

The actuarial reality is that the cost of getting paid has risen faster than the cost of providing care in many systems. That is a striking statement and the data in these calls roughly supports it. Hospital systems are seeing more complex patients, generating more revenue per case, and spending more to capture that revenue. The net margin benefit is muted because the administrative cost layer is growing.

This is also where the disconnect between payer and provider narratives is most visible. Payers talk about medical cost trend management, which on the earnings call sounds like pricing discipline and utilization management. Providers experience the same thing as more denials, more documentation requirements, more prior authorization loops, and more back end friction in getting paid for care that has already been delivered. Both narratives are describing the same underlying activity. They are framed in opposite moral terms, and both framings contain real information.

For anyone building in this space, and several of the calls mention deals or investments in revenue cycle technology and services without ever quite using the phrase, this is one of the most structurally durable problem areas in healthcare. It is not a transient issue waiting for a policy fix. It is getting more complex each year as payer rules proliferate, as more care moves to risk based and value based contracting structures that require new kinds of documentation, and as the underlying clinical acuity of the patient population increases. The vendor landscape around it is fragmented, which is both the opportunity and the challenge. Whoever consolidates durable workflow across the denial management, prior authorization, and patient financial experience stack captures an enormous amount of value, and the large incumbents know it, which is why the strategic activity in this category has been quietly intense.

Noteworthy that Optum Insight, Waystar, R1, and the private equity owned middle layer of revenue cycle services have all been in various stages of repositioning over the last twelve months. Some of that is public, some of it is not. The point is that the capital is flowing where the friction is, and the friction is here.

Where narratives conflict across the stack

Reading the calls side by side, rather than in isolation, is where the most useful insight comes out. The interesting moments are not where the stories agree. They are where the stories should agree and do not.

Providers describe payer mix as favorable and pricing as constructive. Payers describe medical cost trend as elevated and rate increases to providers as moderate. Both of those statements cannot be fully true at the same time. If providers are getting paid meaningfully more per case and payers are not spending meaningfully more per case, the math does not close. The resolution is that both are partially true. Case mix acuity is shifting, so payers are spending more per case partly because the cases are more complex, not only because unit rates are higher. And providers are capturing a mix of rate, acuity, and supplemental payment that reads as favorable on their side without being purely a unit price story. But there is still real tension embedded in the gap, and that tension is where the 2026 and 2027 contract negotiation cycles are going to be painful.

The services story contains a similar tension. Payer calls emphasize growth in pharmacy and care services. The profitability of that growth varies widely by component. High revenue growth in PBM core with lower operating income growth means that growth is not as high quality as the top line suggests. Specialty pharmacy is better, but it is also where employer and regulatory scrutiny is most intense. Care delivery is the highest potential margin and the most capital intensive, and is where the integration risk has been most visible. If you read the services growth narrative as uniformly positive across the components, you miss the real picture. The real picture is a mix of durable margin, compressing margin, and potential margin that is still being built out with uneven execution.

The timing mismatch is the other recurring conflict. Providers are benefiting from higher acuity now, in current period results. Payers are repricing for it with a lag, through bid cycles, contract renewals, and benefit redesigns that take one to two years to fully manifest. During the lag, provider results can look strong while payer results look weak, even when the underlying economic reality is that both sides are converging toward a new equilibrium. The sector level earnings split between the two sides over the last six quarters reflects this lag effect as much as it reflects any real divergence in underlying performance.

The other conflict worth naming is between the vertical integration narrative and the segment level financial reality. The public narrative from the large diversified platforms is that vertical integration is working and delivering the long promised synergies. The segment data shows a more complicated picture, with some components performing well, some being actively restructured, and some being written down. That does not mean the strategy is failing. It means the strategy is expensive and uneven, and investors who take the adjusted narrative at face value without digging into the segment reporting are missing the texture.

Conflicts like these are where the alpha is in reading these calls. Clean consistent narratives across the stack are rare in healthcare. Misalignment is the signal, and the misalignments pointing to the biggest structural shifts are the ones that show up repeatedly across multiple companies, not just in one.

What management teams are signaling vs what they are avoiding

Every management team shapes the narrative, and in healthcare that shaping is especially pronounced because the businesses are complex enough that the framing choices matter a lot.

When a management team talks about adjusted operating income without giving equivalent weight to impairment charges, that is signaling. When revenue growth gets prominent treatment but the associated margin compression only shows up in footnotes and analyst day decks, that is signaling. When the word transitory gets used more than once per call, that is almost always signaling.

Cigna is relatively good at structured disclosure. The segment breakouts are usable and the commentary generally lets you follow the story without heroic reconstruction. That is a compliment, not a setup for a criticism. When management teams structure their reporting to allow real analysis, it is easier for long term investors to get comfortable, and it is harder for short term narrative shifts to distort valuation.

CVS provides a lot of data but relies heavily on adjusted frameworks that remove some of the messier components of recent history. The company is not unusual in this, and management is navigating a genuinely difficult strategic position. But interpreting CVS requires more work than interpreting Cigna, and the adjusted to GAAP bridge is where a meaningful share of the real story sits.

UnitedHealth is a specific case, partly because of the scale and partly because of the current environment. The disclosures have become more structured under pressure, and the commentary around medical cost trend has become more specific over the last several quarters. That is investor demand forcing clarity. It is also an implicit acknowledgment that the prior framing was not sufficient given what was happening underneath.

Hospital operators tend to emphasize same facility metrics, which is the right frame and is genuinely helpful. They often spend less time on the sustainability of supplemental payment programs, the specifics of payer contracting disputes, and the long term implications of payer mix shifts, all of which are material to the forward margin profile. The language around labor is usually specific enough to be useful. The language around revenue cycle and administrative burden is usually general enough to be vague.

Across the entire set, the topic that gets the least structured discussion relative to its actual economic importance is administrative complexity and revenue cycle friction. Every participant is experiencing it. Very few are quantifying it in any useful way on the call. That gap between what is being lived operationally and what is being surfaced narratively is a useful place to focus attention, both for investment analysis and for anyone trying to build a business that addresses the problem.

What this means for operators, builders, and investors

Step back from the specifics and the picture is coherent. The industry is not losing margin. It is redistributing margin. The absolute pool of profit across the healthcare stack has not materially shrunk. It has moved, and it is continuing to move, and the direction of travel is reasonably clear if you squint past the quarterly noise.

Insurance is becoming less reliable as a standalone profit engine. Not unprofitable. Less reliable. The cyclicality of medical cost trend, the structural shift in the senior population, the compression of Medicare Advantage economics, and the ongoing pressure on risk adjustment methodology all point to an insurance business that is more volatile and more capital intensive than the market assumed during the growth years. That does not make it a bad business. It makes it a different business than the one that was being valued in 2019 through 2022.

Services are becoming more central, but the services category is heterogeneous. Pharmacy benefit management in its traditional form is under long term margin pressure from transparency demands, employer sophistication, and regulatory scrutiny. Specialty pharmacy is a better position, with higher growth and more durable economics, though not immune to the same pressures. Care delivery is the highest potential return and the highest integration risk, and the experience of the last three years suggests that execution quality matters more than strategic positioning. Data, analytics, and revenue cycle technology services are the cleanest margin profile in the category, with the caveat that they are smaller in absolute dollars and require real operational scale to generate durable advantage.

Providers are recovering on volume and acuity, but constrained by a cost base that has reset and by an administrative environment that is getting more complex, not less. The good operators will keep grinding incremental margin improvement. The idea of a snap back to pre pandemic sector margins is not supported by anything visible in the current cycle. The weaker operators, particularly the smaller systems without the scale to invest in revenue cycle, labor productivity, and service line rationalization, are going to continue consolidating into larger platforms. That consolidation is itself a margin redistribution event, with value accruing to the acquirers who can integrate efficiently.

For operators inside the system, the implication is that diversification across the value chain is not optional if meaningful scale is the goal. A pure play insurance business, or a pure play hospital system, or a pure play PBM, is a harder business to run in the current environment than it was ten years ago. That does not mean every company should try to be vertically integrated. It means companies that are not vertically integrated need to have a clear answer to why their single segment positioning is durable, and that answer has to account for where the sector level margin is actually accumulating.

For builders, and this is where it gets interesting for anyone working in the early stage and growth stage ends of the market, the friction points in the stack are where durable businesses get made. Revenue cycle and administrative workflow sit at the top of that list. Specialty pharmacy infrastructure, particularly around patient support, benefits investigation, and prior authorization, is another. Care delivery enablement for the new value based contracting structures is a third, though the execution bar is high. Data infrastructure that actually connects clinical, financial, and utilization data in usable form is a fourth, and the existing incumbents have not solved it cleanly despite significant capital deployed.

For investors, the implication that gets most consistently missed is that segment level analysis matters more than consolidated analysis, and consolidated analysis matters more than narrative. The same company can have a weak insurance segment, a compressing PBM segment, a struggling care delivery investment, and a genuinely high quality data and technology business, all at the same time, and the consolidated adjusted earnings number will obscure most of that texture. Valuation that rests on consolidated adjusted numbers without a view on segment level durability is valuation that is going to be surprised by segment level transitions. There have been a lot of segment level transitions in healthcare recently. There are more coming.

The easy narratives have mostly broken. Growth is still there. Profit is still there. Both are just not sitting where they used to sit, and the disconnect between where they used to sit and where they sit now is the single most important thing to internalize about reading these calls. Everything else flows from that.​​​​​​​​​​​​​​​​

What just happened on April 10

The size of the prize, in actual dollars and procedures

Why the old CJR playbook is only partially useful here

Builder opportunity one: the post-acute steerage and PT layer

Builder opportunity two: PROMs as a revenue cycle problem

Builder opportunity three: the outpatient migration toolkit

Builder opportunity four: risk-adjusted target price intelligence

Builder opportunity five: the convener and gainsharing back office

Builder opportunity six: device, implant, and supply rationalization

Builder opportunity seven: rural and safety net co-pilot

Builder opportunity eight: the patient navigation and demand-side play

Channel and GTM notes for anyone selling into this

Closing thoughts on timing, exits, and what could break the thesis

Abstract

Quick framing for anyone skimming:

- CMS dropped the FY27 IPPS proposed rule on April 10, 2026, and tucked inside is CJR-X, the first ever mandatory, nationwide, episode-based payment model in US history.

- Start date: October 1, 2027. Five performance years through Sept 30, 2032. Roughly 3,000+ IPPS hospitals in scope, minus the ~700 already in TEAM and minus Maryland.

- Episode = 90 days post-discharge from inpatient or outpatient hospital LEJR. Triggers: MS-DRG 469, 470, 521, 522, plus HCPCS 27447 (TKA) and 27130 (THA), plus total ankle.

- Risk adjustment jumps from 3 levers in CJR to 29 in CJR-X (same engine as TEAM). 5% stop-loss for safety net, dual-eligible heavy, geographically rural, MDH, and SCH hospitals.

- Quality first: 5 measures including the THA/TKA PRO-PM (CMIT 1618), which CMS plans to weight heavier than TEAM does. PROMs are now a P&L input.

- TAM context: ~1M+ Medicare TKAs and ~600K Medicare THAs annually as of 2022, growing at 5.9% and 7.6% CAGR respectively, with surgeon reimbursement down ~55% inflation-adjusted since 2000. Hospitals are squeezed on the front end and now risk-bearing on the back end.

- Net savings from the original CJR’s PY6 and PY7 (2021 to 2023): $112.7M, with quality flat. CMS has a green light to scale.

- Eight buildable categories laid out in the body, plus channel notes for selling into hospitals, ortho groups, ASCs, SNFs, and home health.

What just happened on April 10

The April 10 release of the FY 2027 IPPS proposed rule, all 1,500-ish pages of it, contained the regulatory equivalent of a starter pistol for healthcare services builders. Buried inside that doorstop is CJR-X, which CMS would like to begin on October 1, 2027 as the first nationwide test of a mandatory episode-based payment model. Public comments are open through June 9, 2026. CMS Administrator Mehmet Oz framed it in the press release as aligning incentives with outcomes and protecting taxpayer dollars, which is the standard phrasing for “we are putting hospitals on the hook for 90 days of post-op spend whether they like it or not.”

The mechanics are familiar to anyone who lived through the original CJR (2016 through 2024) or who has been reading the TEAM tea leaves. Acute care hospitals get a target price covering all Part A and Part B services in a 90 day episode beginning with the procedure. They keep getting paid FFS during the year. After year-end, CMS reconciles actual spend against the target price, applies a quality adjustment based on the composite quality score, and either cuts a check or sends an invoice. Stop-loss is set at 20% for most participants, 5% for the protected categories. The quality first principle still applies, meaning if a hospital fails to clear the minimum composite quality score, no reconciliation payment, full stop.

What is meaningfully different from CJR is the scope. The original ran in 67 metros at peak, then settled into 34 MSAs. CJR-X is every IPPS hospital in the country except Maryland (carved out by the Total Cost of Care waiver) and the roughly 700 hospitals already locked into TEAM, who flip into CJR-X when TEAM expires on December 31, 2030. Total ankle replacement is now in scope. Outpatient hospital procedures are now in scope. The episode definition follows the patient through the HOPD. Critical access hospitals and rural emergency hospitals stay exempt because they sit outside the IPPS/OPPS plumbing.

The other meaningful change is the risk adjustment engine. The old CJR ran with three risk adjusters and got criticized, fairly, for clobbering hospitals that drew from sicker, more complex populations. CJR-X imports the TEAM methodology: 29 adjusters at the episode level (age, HCC count, dual-eligibility, procedure type, disability as the original reason for Medicare enrollment, prior PAC use, plus 21 specific HCCs) and two at the participant level (bed count and dual-eligible share). For builders, this matters more than it sounds. A more sophisticated risk model means hospitals can no longer just “select better patients” to game the model. The acuity is priced in. The only way to win is to actually run a better episode.

The size of the prize, in actual dollars and procedures

Read more

For decades, the United States healthcare system has operated without a single authoritative, machine-readable directory of its providers. Hospitals, insurers, health systems, and technology companies each maintained their own proprietary provider databases - expensive to build, difficult to maintain, and impossible to reconcile with one another. A physician might appear in dozens of databases simultaneously, each with slightly different information about their specialty, location, affiliations, and contact details. This fragmentation imposed enormous costs on the system: prior authorization delays, misdirected referrals, failed care coordination, and billions of dollars spent annually on provider data management by organizations that would rather spend that money on care.

On April 9, 2026, the Centers for Medicare and Medicaid Services (CMS) released the National Provider Directory (NPD) - a single, public, FHIR-formatted dataset containing every Medicare-enrolled provider in the United States. The release, available at https://directory.cms.gov is the most comprehensive public healthcare provider dataset ever assembled. It contains 27,204,567 records across six FHIR resource types, compressed to 2.8 gigabytes and freely downloadable by anyone.

This essay presents the results of a complete analysis of every record in the dataset - not a sample, not an approximation, but a full population analysis of all 27.2 million records. The analysis was conducted using Python streaming scripts, with the most computationally intensive cross-resource graph linkage analysis run on GitHub Actions cloud infrastructure to avoid local compute constraints. The findings reveal both the extraordinary power of what CMS has released and the significant gaps that remain - gaps that represent direct entrepreneurial opportunities for health technology builders.

Alongside this analysis, a working prototype was built to make the data tangible and interactive: the CMS NPD Explorer, available at onhealthcare.manus.space. The application is a six-page React 19 web application built with TypeScript, Tailwind CSS 4, and Recharts, deployed on Manus cloud infrastructure. It was designed with a Federal Data Observatory aesthetic - a deep navy sidebar, Source Serif 4 display typography paired with DM Sans for body text, and a dark-on-light color system that evokes institutional precision rather than consumer-product softness. The site includes an Overview Dashboard displaying all 27.2 million records across the six resource types with live summary statistics; a Practitioners Explorer with searchable and filterable tables across specialty, qualification, gender, and enrollment status; an Organizations Directory with state distribution charts and organizational size breakdowns; a FHIR Endpoints Directory showing EHR vendor market share, endpoint status, and FHIR version distributions; an Analytics Dashboard with six interactive visualizations covering the full dataset; and a Data Model Reference documenting the complete FHIR schema and cross-resource relationship structure. The prototype was built entirely from the raw NPD data - no third-party data enrichment, no commercial provider database - demonstrating that a functional, production-quality provider intelligence application can be built on this public foundation alone.

II. What Was Released: The Six FHIR Resources

The NPD is structured around six FHIR R4 resource types, each capturing a different dimension of the provider ecosystem. Understanding what each resource contains - and what it deliberately omits - is essential for anyone seeking to build on this data.

The format is NDJSON (newline-delimited JSON) compressed with Zstandard at level 12 - a modern, high-ratio compression algorithm that achieves roughly 14:1 compression on these files. Each line in each file is a complete, self-contained FHIR resource. The data was released under a public domain license with no restrictions on use.

III. The Practitioner File: 7.4 Million Individual Providers

The Practitioner file is the backbone of the dataset. With 7,441,212 records, it represents the most comprehensive enumeration of US healthcare providers ever made publicly available. Each record contains a National Provider Identifier (NPI), name, qualifications, specialties, and a set of CMS-specific extensions that reveal the provider's enrollment status.

The Workforce Demographics

The gender distribution is striking: 67.42% of practitioners are female (5,016,631 women) versus 32.14% male (2,389,498 men), with 0.44% unknown. This is not a sample artifact - it was confirmed across all 7.44 million records. It reflects the well-documented feminization of the healthcare workforce, particularly in nursing, behavioral health, and allied health professions, which together constitute the majority of Medicare-enrolled providers.

The qualification landscape reveals the true shape of the modern US healthcare workforce. Nurse Practitioners (NPs) are the single largest specialty category at 8.8% of all practitioners, reflecting two decades of scope-of-practice expansion and the growing reliance on NPs for primary care delivery. The second-largest qualification type, at 8.53%, is Behavior Technician - a finding that would surprise most healthcare observers. This reflects the explosive growth of Applied Behavior Analysis (ABA) therapy for autism spectrum disorder, which became a covered benefit under most state Medicaid programs and commercial insurance plans during the 2010s. The presence of nearly 635,000 behavior technicians in the Medicare enrollment database is a direct artifact of that policy shift.

NPI enrollment peaked in 2006, the year after the NPI mandate took effect under HIPAA, with 1,009,174 new enrollments. The distribution of enrollment years provides a natural audit trail: practitioners enrolled before 2004 are almost certainly physicians or other long-established provider types, while the post-2010 surge reflects the expansion of covered provider categories.

The CMS Enrollment Quality Extensions

Every Practitioner record carries four CMS-specific boolean extensions that have no equivalent in any prior public dataset:

The enrollment-in-good-standing rate of 39.75% is the most consequential finding in the entire dataset. It means that 60.25% of Medicare-enrolled providers — more than 4.4 million practitioners — have some form of enrollment issue. This could mean lapsed enrollment, pending revalidation, excluded status, or simply administrative backlog. For any application that needs to distinguish active, billable providers from historical records, this field is essential.

The IAL2 verification rate of 0% is a statement about the current state of healthcare identity infrastructure. NIST Identity Assurance Level 2 requires in-person or supervised remote identity proofing with document verification. The fact that no provider in the entire dataset has been verified to this standard reflects both the scale of the challenge and the opportunity for identity verification services in healthcare.

What Is Missing from Practitioner Records

The Practitioner file is notable for what it does not contain. Birth dates are absent from all 7.44 million records - a complete absence, not a gap. Languages spoken are present on only 2.8% of records. Photos are absent entirely. Accepting-new-patients status is absent. These omissions are not accidental; they reflect the deliberate scope of the initial release, which prioritized enrollment data over clinical or operational data.

IV. The PractitionerRole File: 7.2 Million Relationships and Their Surprising Fragility

The PractitionerRole resource is where the dataset's most surprising structural finding lives. With 7,180,732 records, it contains one relationship record for each practitioner-organization pairing in the Medicare enrollment system. But 44.85% of all PractitionerRole records are inactive - 3,220,444 records describe historical relationships that no longer exist.

This is not a data quality problem. It is a deliberate design choice: the NPD preserves the full historical record of provider affiliations, not just current relationships. For longitudinal research, this is invaluable. For applications that need to know where a provider works today, it requires careful filtering on the `active` field.

The Linkage Structure

The cross-resource graph analysis, run on GitHub Actions across all 7.18 million PractitionerRole records, reveals the connectivity structure of the dataset:

Every PractitionerRole record has a practitioner reference. 97.99% have an organization reference. 77.21% have a location reference. This means that for 77.21% of all provider-organization relationships, there is a complete three-way link connecting a specific person to a specific organization at a specific location.

The Practitioner Connectivity Gap

When the analysis is inverted - asking how many of the 7.44 million practitioners have any organizational linkage - the picture becomes more complex:

Only 28.70% of practitioners in the dataset are linked to any organization through PractitionerRole records. The remaining 71.30% - more than 5.3 million practitioners - appear in the Practitioner file but have no corresponding PractitionerRole record linking them to an organization or location. This is the single most important structural finding in the dataset: the majority of practitioners are "orphaned" - present in the directory but not connected to any organizational context.

This gap is partly explained by the enrollment history: many of these practitioners may have enrolled in Medicare but never established an active organizational affiliation, or their affiliations may have lapsed. It is also partly a data completeness issue - the NPD is a first release, and the linkage infrastructure between CMS enrollment systems and organizational data is still being built.

For entrepreneurs, this gap is an opportunity. Any application that can accurately link orphaned practitioners to their current organizations - through claims data, state licensing databases, or other sources - would be providing a service that the NPD itself cannot yet deliver.

Multi-Organization Practitioners

Among the 2.1 million practitioners who are linked to organizations, the distribution of organizational affiliations is revealing:

More than half of linked practitioners work across multiple organizations. This reflects the reality of modern medical practice: hospitalists who work at multiple hospitals, specialists who split time between academic medical centers and private practices, and behavioral health providers who contract with multiple group practices simultaneously.

V. The Organization File: 3.6 Million Entities - and a Taxonomy Problem

The Organization file contains 3,605,261 records representing every organizational entity in the Medicare enrollment system. The file is notable for both its coverage and its taxonomic limitations.

55.45% of organizations are typed as "Healthcare Provider" - a FHIR type code that is accurate but unhelpful. It does not distinguish between a solo practitioner's practice, a 500-bed hospital, and a national health system. The remaining 44.55% are typed only as "ein" - meaning they are identified by their tax ID number but have no FHIR organizational type assigned at all.

This taxonomy gap is significant for any application that needs to distinguish between different types of healthcare organizations. A hospital network, a physician group, a pharmacy chain, and a home health agency all appear in the same file with the same type code. Differentiating them requires either enrichment from external sources (like the CMS Provider of Services file or the AHA Annual Survey) or inference from the organization's name and NPI taxonomy codes.

The Health System Hierarchy

The cross-resource graph analysis identified the top organizations by practitioner count - a proxy for organizational scale that has never before been available in a public dataset:

Kaiser Permanente's two medical groups together account for 34,097 practitioners - the largest single health system presence in the dataset. The appearance of Teladoc Health at #16 with 5,472 practitioners is a signal of how dramatically telehealth has scaled: a company that did not exist as a significant healthcare entity a decade ago now employs more Medicare-enrolled providers than most major academic medical centers.

The organization size distribution reveals the extreme fragmentation of US healthcare delivery:

143,491 organizations - 37.1% of all organizations with practitioners - are solo practices. The US healthcare system is dominated by small organizations: 84.2% of all organizations with practitioners have fewer than 11 practitioners. The 599 enterprise organizations with more than 1,000 practitioners collectively represent the major health systems, but they are a tiny fraction of the total organizational landscape.

VI. The Location File: 3.5 Million Addresses - With a Critical Gap

The Location file contains 3,494,239 records representing physical service locations. 46.64% have GPS coordinates - 1,630,294 locations with latitude and longitude at 5+ decimal places (sub-meter accuracy). The geographic distribution mirrors the US population: California leads with 176,913 locations, followed by Florida (134,240) and Texas (126,627).

The critical gap in the Location file is operational data. Hours of operation are absent from 100% of records. Accepting-new-patients status is absent from 100% of records. Available time slots, telehealth availability, and accessibility information are all absent. The Location file tells you where a provider can be found but nothing about when they are available or whether they are accepting new patients.

This gap is the single most important limitation for consumer-facing applications. A patient searching for a primary care physician needs to know not just that a provider exists at a given address, but whether that provider is accepting new patients and when they have availability. The NPD cannot answer either question.

VII. The Endpoint File: 5.0 Million FHIR Connections - and the EHR Market Revealed

The Endpoint file is perhaps the most technically significant resource in the dataset. With 5,043,524 records, it is the largest public enumeration of healthcare interoperability infrastructure ever assembled. Every record represents a machine-readable connection point to a healthcare organization's data systems.

74.21% of endpoints are active (3,742,777 records). 25.79% are in an error or inactive state (1,300,747 records). The inactive endpoints are not random noise - they are a signal about the state of healthcare IT infrastructure. Organizations that have migrated EHR systems, gone out of business, or failed to maintain their FHIR endpoints appear in this file as inactive records.

The EHR Market Share Revelation

The endpoint domain distribution is the first public, population-level view of EHR market share in US healthcare:

These figures require careful interpretation. Cerner's apparent lead over Epic reflects Cerner's historical dominance in hospital and government markets (including the VA and DoD), while Epic's true market share — particularly in large academic medical centers and integrated delivery networks — is substantially understated by the hosted domain count alone. Epic installations at Kaiser, Mayo, Cleveland Clinic, and dozens of major health systems appear under those institutions' own domains, not under epichosted.com.

25.81% of all endpoints - 1,301,977 records - are Direct Project endpoints, not FHIR REST APIs. The Direct Project is a pre-FHIR secure messaging standard developed in 2010 as part of the Meaningful Use program. Its continued presence at this scale reveals that a quarter of healthcare interoperability infrastructure is still running on technology that predates the FHIR standard by nearly a decade. This is both a data quality issue and a market opportunity: any service that can help organizations migrate from Direct to FHIR would be addressing a real and quantifiable need.

100% of endpoints use HTTPS - a baseline security requirement that is universally met. FHIR R4 is the dominant version at 70.6% of all endpoints, with FHIR STU3 accounting for most of the remainder.

VIII. The OrganizationAffiliation File: The Healthcare Network Graph

The OrganizationAffiliation file, at 439,599 records, is the smallest resource in the dataset but arguably the most strategically significant. It is the first public enumeration of the relationships between healthcare organizations - who is affiliated with whom, and in what capacity.

The affiliation code distribution reveals the structure of these relationships:

- 57.10% are Member affiliations: organizations that are members of a network, association, or health system

- 3.33% are HIE/HIO affiliations: 14,622 records documenting participation in Health Information Exchanges

The HIE/HIO records are particularly significant. Health Information Exchanges are the organizations responsible for sharing patient data across provider organizations within a region. Before the NPD, there was no public, machine-readable list of which organizations participated in which HIEs. These 14,622 records are the first such enumeration - a foundation for understanding the actual connectivity of the US health information infrastructure.

The network analysis reveals 98,179 unique organizational hubs with at least one affiliation relationship. The largest network hub has 12,086 member organizations - likely a major national health network or payer-sponsored network. The distribution is highly skewed: 69,429 hubs (70.7%) have only a single affiliation relationship, while a small number of large hubs account for the majority of the network's connectivity.

IX. The Cross-Resource Graph: Connectivity, Gaps, and What They Mean

The most important analytical question about the NPD is not what each individual resource contains, but how well the six resources connect to each other. A healthcare provider directory is only as useful as the completeness of its linkage graph: does each practitioner connect to their organization, their location, and their FHIR endpoint?

The full cross-resource analysis, run on GitHub Actions across all 27.2 million records, produces a definitive answer:

The finding that 0% of practitioners have a complete chain connecting them to an organization, a location, AND an endpoint is the most important structural insight in the entire dataset. The endpoint references in the Practitioner file use a different reference format than expected by the cross-resource join — the Endpoint file's records are linked through PractitionerRole and Organization, not directly through Practitioner extension references. This means the full five-resource chain (Practitioner → PractitionerRole → Organization → Location → Endpoint) exists for the 27.74% of practitioners who have both organizational and location linkage, but the endpoint leg of the chain runs through the organization, not the practitioner directly.

The 71.30% of practitioners with no organizational linkage at all represents the dataset's most significant completeness gap. These are practitioners who are enrolled in Medicare but whose organizational affiliations are either not captured in the NPD or have lapsed. Closing this gap - connecting orphaned practitioners to their current organizations - is one of the most valuable enrichment tasks that can be performed on this dataset.

X. The Entrepreneur's Guide: Eight Ventures the NPD Makes Possible

The NPD is not just a dataset. It is infrastructure - the kind of infrastructure that enables an entire generation of applications that were previously impossible or prohibitively expensive to build. The following eight venture categories represent the most direct and defensible opportunities.

1. The Provider Search Engine

The most obvious application is also the most valuable: a consumer-facing provider search engine that is actually comprehensive. Existing provider directories - Zocdoc, Healthgrades, WebMD - are built on proprietary data that is expensive to acquire and difficult to maintain. The NPD provides a free, comprehensive foundation. The value-add is enrichment: layering in accepting-new-patients status (from payer directories or direct provider outreach), appointment availability (from scheduling APIs), patient reviews (from CMS's existing review data), and telehealth availability.

The NPD's 3.49 million location records with 46.64% GPS coverage provide the geographic foundation. The 7.44 million practitioner records with specialty data provide the clinical foundation. The 5.04 million endpoint records provide the interoperability foundation. A search engine built on this data would have coverage that no proprietary directory can match.

2. EHR Connectivity Intelligence

The endpoint file is a real-time map of which EHR systems are deployed where. For health IT vendors, this is a sales intelligence tool of extraordinary value. A company selling a clinical decision support module, a revenue cycle management tool, or a patient engagement platform can use the endpoint data to identify every organization running a specific EHR, segment them by geography and size, and prioritize outreach accordingly.

The 12.97% Cerner market share, 8.40% athenahealth share, and 7.38% Epic hosted share are the first population-level EHR market data ever made publicly available. For any company that sells into healthcare, this data is more valuable than any analyst report.

3. Prior Authorization Automation

Prior authorization - the process by which insurers require providers to obtain approval before delivering certain services - is one of the most expensive and time-consuming administrative burdens in US healthcare. The NPD's endpoint data makes it possible to route prior authorization requests directly to the right FHIR API endpoint for any organization in the country.

A prior authorization automation platform built on the NPD could identify the FHIR endpoint for any ordering provider's organization, submit the authorization request programmatically, and receive a response without any manual fax or phone call. The 5.04 million endpoint records represent the infrastructure for this automation. The 25.81% of endpoints that are still Direct Project (legacy fax-equivalent) represent the market for migration services.

4. Healthcare CRM and Sales Intelligence

Every company that sells to healthcare providers - pharmaceutical companies, medical device manufacturers, health IT vendors, staffing agencies - maintains expensive proprietary databases of provider information. The NPD makes it possible to build a comprehensive, free-to-use foundation layer that these companies can enrich with their own data.

The top-50 organizations by practitioner count, the org size distribution, the specialty breakdown, and the geographic distribution are all now public. A healthcare CRM built on the NPD would have structural advantages over any proprietary competitor: lower data acquisition costs, more comprehensive coverage, and a foundation that updates with each NPD release.

5. HIE Participation Analytics

The 14,622 HIE/HIO affiliation records are the first public enumeration of Health Information Exchange participation in the United States. Before the NPD, there was no way to know, from public data, which organizations participated in which HIEs. This information is now available.

A platform that maps HIE participation - showing which regions have strong HIE coverage, which organizations are connected to which exchanges, and where the connectivity gaps are - would be valuable to state health departments, ACOs, and any organization trying to understand the actual state of health information sharing in their market.

6. Workforce Analytics and Staffing Intelligence

The NPD's practitioner data - 7.44 million records with specialty, qualification, gender, enrollment year, and geographic distribution - is the most comprehensive public dataset on the US healthcare workforce ever assembled. A workforce analytics platform built on this data could answer questions that no existing tool can: What is the ratio of NPs to physicians in rural counties? How has the behavioral health workforce grown since 2015? Which specialties are most concentrated in specific metropolitan areas?

For healthcare staffing agencies, this data is a prospecting tool. For health systems doing workforce planning, it is a benchmarking resource. For policymakers, it is a foundation for evidence-based workforce policy.

7. Care Gap and Desert Identification

The combination of location data (with GPS coordinates) and specialty data makes it possible to identify healthcare deserts - geographic areas with insufficient access to specific types of care. The NPD's 3.49 million location records, combined with census population data, enable the first comprehensive, population-level mapping of care access at the ZIP code or census tract level.

A care gap analytics platform could identify every county in the United States where the ratio of behavioral health providers to population falls below a threshold, or where there are no oncologists within 50 miles, or where the nearest FHIR-connected provider is more than an hour's drive away. This is the kind of analysis that health plans, ACOs, and state Medicaid programs need for network adequacy compliance.

8. Provider Data Enrichment and Verification

The NPD's CMS enrollment quality extensions — particularly the 39.75% enrollment-in-good-standing rate — create a new market for provider data enrichment and verification services. Any organization that needs to know whether a specific provider is currently in good standing with Medicare now has a free, authoritative source. But the 60.25% of providers who are not in good standing need to be investigated further: are they excluded, lapsed, or simply pending revalidation?

A verification service that combines the NPD's enrollment quality flags with the OIG exclusion list, state licensing board data, and DEA registration data would provide a comprehensive provider credentialing foundation. This is the core function of CAQH, which charges health plans and providers significant fees for this service. The NPD makes it possible to build a competitive alternative on a free foundation.

XI. The Prototype: CMS NPD Explorer

To demonstrate the practical utility of the NPD, a working prototype application was built: the CMS NPD Explorer, available live at onhealthcare.manus.space. The application is a six-page React application with a Federal Data Observatory design aesthetic - deep navy sidebar, Source Serif 4 and DM Sans typography, and recharts-powered visualizations.

The prototype includes:

Overview Dashboard - A hero statistics panel showing all 27.2 million records across the six resource types, with a summary of key findings from the complete population analysis.

Practitioners Explorer - A searchable, filterable table of practitioner records with specialty, qualification, gender, and enrollment status filters. The table demonstrates how the NPD can be used as a foundation for provider search.

Organizations Directory - An organizational directory with state distribution charts and size distribution visualizations, demonstrating the extreme fragmentation of US healthcare delivery.

FHIR Endpoints Directory - An endpoint directory with EHR vendor breakdown, status distribution, and FHIR version analysis, demonstrating the interoperability intelligence available in the dataset.

Analytics Dashboard - Six interactive recharts visualizations covering specialty distribution, qualification breakdown, gender distribution, EHR market share, geographic distribution, and data quality scoring.

Data Model Reference - A complete FHIR schema reference for all six resource types, with field-level documentation and cross-resource relationship diagrams.

The prototype is intentionally a demonstration, not a production application. It uses embedded sample data rather than live API calls to the full dataset, which would require a backend server capable of streaming and indexing the 2.8 GB compressed files. A production implementation would require either a DuckDB-based query layer, an Elasticsearch index, or a purpose-built FHIR server.

XII. Data Quality Assessment

A complete data quality assessment across all six resources, based on the full population analysis, produces the following scorecard:

The overall picture is of a dataset that is excellent on identity (NPI, name, organization name) but incomplete on operational data (hours, availability, accepting patients) and connectivity (only 28.70% of practitioners are linked to organizations). This is consistent with a first release that prioritizes enrollment data over operational data.

XIII. The Regulatory Foundation: Why This Data Will Improve

The NPD was released under the authority of the 21st Century Cures Act (2016) and the CMS Interoperability and Patient Access Final Rule (2020). These regulations require CMS to make provider directory data available in a standardized, machine-readable format and require payers to maintain accurate provider directories as a condition of participation in Medicare Advantage and Medicaid managed care.

The regulatory pressure on data quality will increase over time. The No Surprises Act (2022) created new requirements for provider directory accuracy, with financial penalties for plans that maintain inaccurate directories. As CMS links NPD data to claims data, quality reporting data, and enrollment data, the completeness and accuracy of the directory will improve.

The current gaps - particularly the 71.30% of practitioners with no organizational linkage and the 0% hours-of-operation coverage - are not permanent features of the dataset. They reflect the current state of CMS's data integration infrastructure. Future releases will incorporate data from payer directories (required to be submitted to CMS under the Interoperability Rule), state licensing boards, and direct provider attestation systems.

For entrepreneurs, this trajectory matters. The NPD is not a static dataset - it is a living infrastructure that will become more complete and more accurate with each release. Applications built on the NPD today will benefit from those improvements automatically.

XIV. Conclusion: The Infrastructure Moment

The release of the CMS National Provider Directory is an infrastructure moment for US healthcare technology - comparable to the release of the NPI registry in 2005 or the publication of Medicare claims data in 2012. It does not solve every problem in healthcare data, but it creates a foundation that makes a new generation of applications possible.

The complete analysis of all 27,204,567 records reveals a dataset that is simultaneously more powerful and more incomplete than its surface description suggests. It is more powerful because it contains the first public EHR market share data, the first public HIE participation enumeration, the first public enrollment quality flags, and the first public enumeration of the organizational structure of US healthcare at population scale. It is more incomplete because 71.30% of practitioners have no organizational linkage, 0% of locations have hours of operation, and 25.81% of endpoints are still running on pre-FHIR legacy technology.

These gaps are not obstacles. They are the market. Every gap in the NPD is a problem that a health technology entrepreneur can solve — by enriching the data, by building the missing linkages, by migrating the legacy endpoints, by adding the operational data that CMS has not yet captured. The NPD provides the foundation; the entrepreneurs provide the structure.

The 27.2 million records in this dataset represent every Medicare-enrolled provider in the United States. They represent the infrastructure of American healthcare - the people, organizations, locations, and technology systems through which care is delivered. That infrastructure is now public, free, and machine-readable for the first time. What gets built on it will define the next decade of health technology.

---

References

[1] CMS National Provider Directory. Centers for Medicare and Medicaid Services. https://directory.cms.gov/

[2] Health Tech Ecosystem Data Release Specifications. GitHub. https://github.com/ftrotter-gov/HTE_data_release_specifications

[3] 21st Century Cures Act, Pub. L. No. 114-255 (2016). https://www.congress.gov/bill/114th-congress/house-bill/34

[4] CMS Interoperability and Patient Access Final Rule (CMS-9115-F). Federal Register, 85 FR 25510 (2020). https://www.federalregister.gov/documents/2020/05/01/2020-05050/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and

[5] HL7 FHIR R4 Specification. HL7 International. https://hl7.org/fhir/R4/

[6] National Plan and Provider Enumeration System (NPPES). CMS. https://npiregistry.cms.hhs.gov/

[7] No Surprises Act, Consolidated Appropriations Act of 2021, Pub. L. No. 116-260 (2020). https://www.congress.gov/bill/116th-congress/house-bill/133

[8] NIST Special Publication 800-63A: Digital Identity Guidelines — Enrollment and Identity Proofing. NIST. https://pages.nist.gov/800-63-3/sp800-63a.html

[9] Direct Project Overview. HealthIT.gov. https://www.healthit.gov/topic/standards-technology/direct-project

[10] CMS Provider of Services File. CMS. https://data.cms.gov/provider-characteristics/hospitals-and-other-facilities/provider-of-services-file-hospital-non-hospital-facilities

What actually shipped on April 16

Benchmarks, with the appropriate skepticism

The plugin is the real story

Trusted access, biosecurity, and why the gate matters

Where this lands inside the pharma stack

What gets compressed, what gets created, what gets killed

Read-throughs for tools, data, and services companies

Angel and seed-stage implications

The quiet part about moats

Caveats, open questions, and the boring stuff nobody wants to talk about

So what now

Abstract

- OpenAI shipped GPT-Rosalind on April 16, 2026, its first purpose-built domain model, aimed at biochemistry, genomics, and protein engineering

- Access is gated via a trusted-access program; launch partners include Amgen, Moderna, Thermo Fisher Scientific, Allen Institute, plus a Los Alamos collab on protein and catalyst design

- Claimed benchmark results: 0.751 pass rate on BixBench, beats GPT-5.4 on 6 of 11 LABBench2 tasks, and in a Dyno Therapeutics eval on unpublished RNA sequences, best-of-10 submissions cleared the 95th percentile of human experts on sequence-to-function prediction and roughly 84th percentile on sequence generation

- A Life Sciences research plugin for Codex connects the model to 50+ scientific tools and public bio databases, which is arguably more commercially important than the model weights themselves

- Preview phase does not consume tokens or credits for approved orgs, meaning the effective price is zero for the enterprise tier, which will distort willingness-to-pay data across the entire biotech software market for roughly 6 to 12 months

- Read-through for founders: data-access wrappers, lit-review tools, and protocol-design copilots with no proprietary data are now at existential risk; differentiated wet-lab data, closed-loop experimentation, regulated workflows, and vertical systems of record are relatively safer

- Read-through for angels: pause any check into a pure RAG-over-PubMed startup, underwrite biotech software against a post-Rosalind baseline rather than a GPT-4-era baseline, and lean into companies producing new, non-public scientific data

- Caveats: dual-use risk is non-trivial, no fully AI-discovered drug has cleared phase 3, and OpenAI’s benchmark numbers are self-reported against evals where OpenAI had training-time knowledge of the tasks

What actually shipped on April 16

OpenAI pushed out three things in a single announcement, and the health tech crowd keeps conflating them. Separating the three is how the analysis gets interesting.

The first is GPT-Rosalind itself, a frontier reasoning model in a new Life Sciences series. It is designed to support evidence synthesis, hypothesis generation, experimental planning, and multi-step scientific workflows across biochemistry, genomics, and protein engineering.  Named after Rosalind Franklin, which is a nice bit of historical housekeeping given the Nobel committee’s 1962 miss. The model is available in ChatGPT, Codex, and the API, but you cannot just sign up for it.

The second is the gating layer, which OpenAI calls the trusted access program. Eligibility is restricted to qualified enterprise customers in the US working on health-relevant research, with governance and safety oversight controls in place. Launch partners named publicly are Amgen, Moderna, Thermo Fisher Scientific, and the Allen Institute, plus an existing collaboration with Los Alamos National Laboratory on AI-guided protein and catalyst design. During the preview, usage does not consume existing credits or tokens for approved orgs, subject to abuse guardrails. The pricing part is worth staring at for a minute. OpenAI is effectively giving the model away to pharma at the moment, which is a fairly aggressive land grab and is going to wreck price discovery for every startup trying to sell AI-for-biotech software to the same buyers.

The third is the Life Sciences research plugin for Codex, published to GitHub. The plugin connects models to over 50 scientific tools and data sources,  including human genetics, functional genomics, protein structure, and clinical evidence data. Quietly, OpenAI said it is also making the connectors and the plugin more broadly available for use with mainline models, not just Rosalind. That matters more than the model itself. More on that below.

Benchmarks, with the appropriate skepticism

The benchmark numbers are noteworthy but worth reading carefully, because every model vendor publishes whatever makes their thing look good.

Read more

Abstract

The Setup: What Even Is This Company

The Steam Engine Problem and Why Interpretability Matters Now

Inside the Ember Platform: What the Tech Actually Does

The Life Sciences Play: Alzheimer’s Biomarkers, Evo 2, and Mayo Clinic

The Business: Funding, Valuation, and Who Wrote the Checks

The Team Card

Where This Fits in the Health Tech Investment Landscape

The Bull Case and the Bear Case

So What

Abstract

- Goodfire is a San Francisco based AI research lab and public benefit corporation focused on mechanistic interpretability, the science of reverse engineering neural networks to understand how they work internally

- Founded in 2023 by Eric Ho (CEO), Dan Balsam (CTO), and Tom McGrath (Chief Scientist, formerly of Google DeepMind’s interpretability team)

- Raised $209M total across three rounds: $7M seed (Aug 2024), $50M Series A (Apr 2025, led by Menlo Ventures with Anthropic participating), $150M Series B (Feb 2026, led by B Capital, valued at $1.25B)

- Core product is Ember, a model design environment that provides programmatic access to neural network internals for feature steering, hallucination reduction, and behavior modification

- Key health/life sciences milestones: identified novel Alzheimer’s biomarkers by reverse engineering Prima Mente’s epigenetic model (first natural science finding from foundation model interpretability), decoded Arc Institute’s Evo 2 genomic model (published in Nature), collaboration with Mayo Clinic on genomic medicine, and TIME magazine feature (Apr 2026) on genetic disease diagnosis

- Claimed results: 58% hallucination reduction in LLMs at 90x lower cost than LLM-as-judge approaches, 30% improvement in viable candidate materials from diffusion models

- ~51 employees as of Jan 2026, team includes researchers from OpenAI, DeepMind, Harvard, Stanford

- Investors include B Capital, Menlo Ventures, Lightspeed, Anthropic, Salesforce Ventures, Eric Schmidt, DFJ Growth, Wing Venture Capital, South Park Commons

- Health tech relevance: interpretability positions as a critical enabling layer for any AI system deployed in clinical, diagnostic, or life sciences contexts where “trust the black box” is not an acceptable answer

The Setup: What Even Is This Company

Goodfire is one of those companies that requires you to think about two or three things at once, which is probably why it gets less coverage in health tech circles than it deserves. On the surface, it looks like a pure AI safety play. San Francisco research lab, public benefit corporation, bunch of former OpenAI and DeepMind researchers doing deep technical work on how neural networks function internally. And yeah, that is what they do. But the health and life sciences applications that have come out of this work are some of the most interesting things happening at the intersection of AI and biomedicine right now, and the angel investing community should be paying very close attention to the downstream implications.

The company was founded in 2023 by Eric Ho, Dan Balsam, and Tom McGrath. McGrath is probably the name that matters most from a credibility standpoint if you care about the research pedigree, because he founded the interpretability team at Google DeepMind before leaving to cofound Goodfire. Balsam serves as CTO and has publicly called interpretability “the most important problem in the world,” which is the kind of statement that either makes you roll your eyes or lean in depending on your priors about where AI is headed. Ho is the CEO and the one doing most of the public talking, including a Bloomberg interview where he said what the AI industry is doing right now is “quite reckless.” That quote probably did not endear him to the scaling labs, but it tracks with the company’s overall thesis.

So what is the thesis? It goes something like this: every major engineering discipline in human history has been gated by fundamental science. You could build steam engines before thermodynamics, but they were wildly inefficient and you could not predictably improve them because nobody understood why they worked. AI is at that exact inflection point. The scaling labs (OpenAI, Google, Anthropic, etc.) are building increasingly powerful systems with very limited understanding of what goes on inside the models. This means nobody can reliably predict when these systems will fail, nobody can surgically fix specific failure modes, and nobody can extract the knowledge that these models have clearly learned from training data but keep locked inside a black box. Goodfire exists to change that by building the science and tooling for mechanistic interpretability, which is basically the discipline of reverse engineering neural networks to figure out what individual components do and how they interact.

The Steam Engine Problem and Why Interpretability Matters Now

The steam engine analogy that Ho keeps using is actually pretty good, so it is worth sitting with for a second. Before thermodynamics gave engineers a theoretical framework for understanding heat and energy transfer, improving steam engines was basically trial and error. You would change something, see if it worked, change something else. Sound familiar? That is more or less how the entire AI industry trains and fine-tunes models today. You adjust training data, tweak hyperparameters, run RLHF, do some eval benchmarks, and hope for the best. The industry term for this, which Goodfire uses frequently, is “guess and check.” Their pitch is that interpretability is the thermodynamics that turns AI development from alchemy into precision engineering.

This framing lands differently depending on whether you are thinking about chatbots or clinical decision support. If Claude or ChatGPT hallucinates a restaurant recommendation, the stakes are low. If a genomic foundation model makes a pathogenicity prediction that influences a clinical decision, the stakes are very high. And this is where the health tech angle gets interesting, because the FDA and CMS are both moving toward requiring more explainability from AI systems deployed in healthcare settings. The regulatory trajectory is pretty clearly pointing toward a world where “we do not know why the model made that prediction” stops being an acceptable answer in clinical contexts. Goodfire is building the toolkit that could become essential infrastructure for anyone trying to deploy AI in regulated health markets.

The company self-identifies as part of a new category they call “neolabs,” which are research-first AI companies pursuing fundamental breakthroughs in training methodology that the scaling labs have mostly neglected because they have been too busy racing to make models bigger. Whether the neolab framing sticks as a category label remains to be seen, but the underlying observation is correct: there has been a massive resource allocation toward making models larger and a relatively tiny investment in understanding them. Ho has pointed out that there are probably fewer than 150 full-time interpretability researchers in the world. For a technology that is being deployed across healthcare, finance, defense, and basically every other consequential domain, that number is absurdly small.

Inside the Ember Platform: What the Tech Actually Does

The flagship product is called Ember, and it is essentially a model design environment (their term) that gives developers and researchers programmatic access to the internal mechanisms of neural networks. To understand what this means, you need a quick primer on the underlying science.

Neural networks consist of artificial neurons that individually have simple designs but interact in enormously complex ways. Tens of thousands of neurons might be involved in generating a single prompt response. The challenge is that individual neurons do not map neatly to individual concepts. This is the superposition problem: neurons contribute to multiple features simultaneously, so the conceptual representations inside a model are all tangled up between physical components. The field of mechanistic interpretability has developed tools called sparse autoencoders (SAEs) that can disentangle these representations and extract human-interpretable features from model activations. A feature might correspond to a concept like “formal tone” or “medical terminology” or “protein secondary structure.” It depends entirely on the model and the training data.

Ember takes these research techniques and packages them into a platform with several practical capabilities. Feature steering lets you tune model internals to shape how an AI model thinks and responds. They have built an “Auto Steer” mode that finds relevant features and activation strengths from a short prompt, which basically means you can tell the system what behavior you want changed and it figures out which internal knobs to turn. One of the more compelling demos has been conditional feature steering for jailbreak prevention: by detecting jailbreak patterns and amplifying the model’s refusal features, they showed dramatically increased robustness to adversarial attacks without affecting normal performance, latency, or cost.

On the diagnostic side, Ember provides tools for identifying why models behave in specific ways. Their SPD method works by identifying model components that may be involved in generating a response and removing them one by one. If removing a component does not affect the output, researchers can conclude it is not part of the relevant processing chain. Think of it like lesion studies in neuroscience, where you figure out what brain regions do by observing what happens when they are damaged. Same logic, applied to artificial neural networks.

They also claim a 58% reduction in LLM hallucinations by using interpretability to guide model training, at roughly 90x lower cost per intervention compared to LLM-as-judge approaches, with no degradation on standard benchmarks. If those numbers hold up across diverse deployments, that is a genuinely significant result. Hallucination reduction has been one of the hardest problems in making LLMs production-ready for high-stakes applications, and most existing approaches involve expensive post-hoc filtering or additional model calls that add latency and cost. A method that targets the internal mechanisms responsible for hallucination and fixes them at the training level is a fundamentally different and more elegant approach.

The Life Sciences Play: Alzheimer’s Biomarkers, Evo 2, and Mayo Clinic

Alright, here is where things get really interesting for the health tech crowd. Goodfire has three major life sciences collaborations that showcase different aspects of what interpretability can do for biomedicine, and each one represents a different flavor of value creation.

The Prima Mente collaboration produced what Goodfire calls the first major finding in the natural sciences obtained from reverse engineering a foundation model. Prima Mente built an AI model that analyzes cell-free DNA (cfDNA) fragments to detect Alzheimer’s disease. cfDNA is DNA that floats freely in the bloodstream after cells die and release their contents, and it carries epigenetic marks that reflect the cellular environment it came from. Prima Mente trained their model (called Pleiades) on this data and got good predictive performance, but could not explain what the model was actually learning. Enter Goodfire. By applying their interpretability toolkit, Goodfire’s researchers discovered that the model was primarily relying on cfDNA fragment length as a diagnostic signal. This finding was not previously documented in scientific literature. The fragment length pattern represents a novel class of Alzheimer’s biomarkers surfaced entirely through AI interpretability.

Think about what happened here. A neural network trained on biological data learned something about disease mechanisms that human scientists had not identified. The knowledge was trapped inside the black box. Interpretability tools opened the box, extracted the insight, and made it available for traditional scientific validation. Goodfire frames this as “model-to-human knowledge transfer,” and it is a genuinely new paradigm for scientific discovery. The model becomes a source of testable hypotheses rather than just a prediction machine.

The Arc Institute collaboration focused on Evo 2, a genomic foundation model trained on DNA sequences. Goodfire decoded Evo 2’s internal representations and found features that map onto known biological concepts, from coding sequences to protein secondary structure. This work was published in Nature. The interesting thing here is not just that the model learned biology (you would hope it did, given the training data) but that interpretability tools could recover the conceptual structure. They literally found the tree of life embedded in the model’s activation patterns.

The Mayo Clinic collaboration, announced in September 2025, takes the genomic interpretability work into a clinical research context. The stated goal is to reverse engineer advanced genomics foundation models to understand what they have learned about genomic relationships, disease mechanisms, and biological processes. Dan Balsam’s framing of this was pretty direct: generative AI has made enormous progress in modeling complex biological systems, but clinical deployment remains blocked because there is a disconnect between model predictions and real-world biological understanding. Interpretability is the bridge. Mayo Clinic has a financial interest in the technology, which tells you something about how seriously they are taking this.

Then just this week, TIME magazine ran a feature on Goodfire’s work with Mayo Clinic researchers using Evo 2 to predict which genetic mutations cause disease and, critically, to explain why. The approach achieved state-of-the-art performance on pathogenicity prediction with interpretable-by-design outputs. Given that the cost of genome sequencing has dropped to around $100 per genome, the bottleneck is increasingly shifting from data generation to data interpretation. A tool that can predict pathogenic variants and provide mechanistic explanations is exactly what the precision medicine ecosystem needs. There are caveats, of course. Stanford’s James Zou has pointed out that finding known biological concepts inside a model does not guarantee the model was actually using those concepts to make its predictions. Clinical validation requires larger trials across diverse populations and FDA approval. But the direction of travel is clear.

The Business: Funding, Valuation, and Who Wrote the Checks

The funding trajectory tells its own story. Seed round of $7M in August 2024, led by Lightspeed. Series A of $50M in April 2025, less than a year after founding, led by Menlo Ventures with Anthropic as a notable participant. Then Series B of $150M in February 2026, led by B Capital, with a $1.25B valuation. Total funding: $209M across three rounds.

The cap table is worth examining because of what it signals about market conviction. Anthropic, which is probably the most credible voice in AI safety and the company that literally pioneered constitutional AI, participated in the Series A. That is Dario Amodei’s shop putting money behind the belief that external interpretability research has commercial value. Eric Schmidt personally invested in the Series B. Salesforce Ventures came in on the B round as well, which suggests enterprise AI buyers see interpretability tooling as a procurement category they will eventually need. B Capital, which led the B round, has over $9B in AUM and focuses on technology and healthcare. The general partner who led the deal, Yanda Erlich, was formerly COO and CRO at Weights and Biases, which means he watched thousands of ML teams struggle with model behavior and presumably concluded that the interpretability layer was the missing piece.

The valuation jump from wherever it was at Series A to $1.25B at Series B is aggressive for a company with around 51 employees and what appears to be relatively early commercial traction. This is not a SaaS business with predictable recurring revenue (at least not yet). It is a research-first organization that is converting scientific breakthroughs into a platform while simultaneously pursuing fundamental research. The Series B press release explicitly says the funding will support green-field research into new interpretability methods alongside product development and partnership scaling. That is an unusual capital allocation mix for a company raising at unicorn valuations, and it suggests investors are pricing in the platform option value rather than near-term revenue.

The Team Card

For a 51-person company, the research bench is unusually deep. Tom McGrath founded interpretability at DeepMind. Nick Cammarata was a core contributor to the original interpretability team at OpenAI. Leon Bergen is a professor at UC San Diego who is on leave to work at Goodfire. The broader team includes researchers from Harvard, Stanford, and top ML engineering talent from OpenAI and Google. Mark Bissell and Myra Deng (Head of Product, formerly at Palantir working with health systems) have been doing the public technical evangelism on how the platform translates from research to production deployments.

The Palantir connection through Deng is actually interesting for health tech investors to note. Palantir has significant health system deployments, and Deng’s background in forward-deployed engineering at health systems means she has firsthand experience with the gap between what AI can do in a research setting and what it takes to deploy in clinical environments. That translational experience is exactly what you want on the product team of a company trying to move from research papers to production tools in healthcare.

Where This Fits in the Health Tech Investment Landscape

A few things jump out. First, interpretability as a category is becoming real. When Anthropic invests in your Series A and Eric Schmidt writes a personal check for your Series B, the market is telling you that “understanding what AI models actually do internally” is transitioning from academic curiosity to commercial necessity. For health tech investors, this means any portfolio company deploying foundation models in clinical or regulatory-sensitive contexts should be thinking about interpretability tooling as part of their technical architecture. The question to ask founders is not just “what model are you using” but “can you explain what the model learned and why it makes specific predictions.”

Second, the model-to-human knowledge transfer paradigm that Goodfire demonstrated with the Alzheimer’s biomarkers is potentially a massive unlock for biotech and diagnostics. The basic idea is that AI models trained on large biological datasets may have already learned things about disease biology that human researchers have not discovered yet. Interpretability provides the extraction mechanism. If this paradigm scales, we could see a wave of startups building on top of interpretability-enabled scientific discovery, using AI models as hypothesis generation engines and then feeding those hypotheses into traditional wet lab validation pipelines. That is a very different (and potentially much faster) drug discovery and diagnostics development cycle than what exists today.

Third, the regulatory angle matters more than most people appreciate. CMS has been tightening requirements around AI transparency in healthcare. The EU AI Act has explicit provisions for high-risk AI systems in healthcare. The FDA’s approach to AI/ML-based software as a medical device keeps evolving toward greater explainability requirements. A company that can provide interpretability-as-a-service for healthcare AI deployments is positioned to become critical infrastructure. Goodfire might do this directly, or (more likely) the techniques and tooling they develop will get embedded in the compliance and deployment stacks of health AI companies across the ecosystem.

Fourth, and this is more speculative, the convergence of interpretability with genomic foundation models could reshape how we think about precision medicine. If you can reverse engineer what a genomic model learned about variant pathogenicity and generate mechanistic explanations, you have a path toward AI-augmented genetic counseling at scale. The cost of sequencing keeps dropping. The bottleneck is interpretation. Interpretability applied to genomic AI models directly addresses that bottleneck. Health tech investors should be watching for startups that sit at this intersection.

The Bull Case and the Bear Case

The bull case is pretty straightforward. AI is eating healthcare. Regulatory and clinical requirements demand explainability. Goodfire is building the foundational science and tooling for AI explainability. They have the best team in the world for this specific problem, early proof points in life sciences, institutional partnerships with places like Mayo Clinic and Arc Institute, and enough capital to sustain a long research program. If interpretability becomes as essential to AI deployment as testing and monitoring are to software deployment (which seems likely), the market opportunity is enormous and Goodfire has a massive head start.

The bear case requires a bit more nuance. Research-first companies have historically struggled to convert scientific breakthroughs into sustainable commercial businesses. The gap between “we can do cool things with interpretability in a controlled research setting” and “here is a product that reliably improves model behavior across diverse production deployments with predictable unit economics” is real and has killed many promising startups. The $1.25B valuation prices in a lot of future execution. There is also the question of whether the scaling labs (OpenAI, Anthropic, Google) build sufficient interpretability tooling internally and make third-party solutions less necessary. Anthropic in particular has been doing serious interpretability research of its own, and the fact that they invested in Goodfire’s Series A could be read either as validation of external interpretability companies or as a hedge that keeps a potential competitor close.

There is also a timing question specific to healthcare. The regulatory requirements for AI explainability in clinical settings are clearly tightening, but the exact timeline and stringency of those requirements remain uncertain. If regulators move slowly, the commercial pull for interpretability tooling in healthcare could take longer to materialize than the bull case assumes. And the Stanford criticism from James Zou is worth taking seriously: finding biological concepts inside a model is different from proving the model used those concepts for its predictions. The validation requirements for clinical applications of interpretability-derived insights will be rigorous, and rightly so.

So What

For health tech angels and entrepreneurs, Goodfire represents something bigger than any single company. It represents the maturation of a new layer in the AI infrastructure stack that is particularly relevant to healthcare. The days of deploying black-box AI in clinical settings and hoping for the best are numbered, and the companies that figure out how to make AI transparent, steerable, and debuggable in healthcare contexts are going to capture enormous value.

Meanwhile, Goodfire keeps publishing research, signing partnerships with places like Mayo Clinic, and hiring researchers from the labs that built the foundation models everyone else is trying to deploy. Whether the $1.25B valuation proves prescient or premature will depend on execution, but the underlying bet, that understanding AI is as important as building AI, looks increasingly sound. Especially in a domain like healthcare where the consequences of not understanding what your model is doing can be measured in patient outcomes rather than just customer churn.​​​​​​​​​​​​​​​​

Amazon Web Services launched Amazon Bio Discovery on April 15, 2026 at its annual AWS Life Sciences Symposium. The platform gives scientists access to 40-plus biological foundation models (bioFMs), an AI agent layer that orchestrates multi-model workflows, and a direct integration with wet-lab CRO partners including Ginkgo Bioworks, Twist Bioscience, and A-Alpha Bio. The MSK collaboration generated 300,000 antibody candidates and narrowed to 100,000 for lab testing in weeks versus the usual year-plus timeline. Early adopters include Bayer, Voyager Therapeutics, and the Broad Institute. 19 of the top 20 global pharma companies already run on AWS cloud. Pricing is outcome-based, starting with a free trial of 5 experiments. Key investors and founders in this space should care because: (1) AWS is entering a market previously dominated by pure-play AI biotechs with dramatically lower structural costs; (2) the platform collapses the in silico to wet-lab handoff in ways that change the CRO economics model; (3) bioFMs are commoditizing, and data moats are everything; (4) this changes the angel/venture entry thesis around AI drug discovery plays; (5) the lab-in-the-loop cycle creates a compounding institutional knowledge asset that favors incumbents with proprietary data.

Table of Contents

Setting the Stage: Why Antibody Discovery Was Already Broken

What Amazon Bio Discovery Actually Is

The MSK Validation Story and Why It’s a Big Deal

The CRO Integration Play: Ginkgo, Twist, and A-Alpha Bio

Who’s Already Using It and What That Signals

Competitive Landscape: Where Does This Leave Recursion, Schrödinger, Insilico

The Data Moat Thesis and Why Models Commoditize

Investment Implications for Health Tech Angels and Early-Stage Founders

Caveats, Open Questions, and What to Watch Next

Setting the Stage: Why Antibody Discovery Was Already Broken

The traditional antibody discovery timeline has always been a combination of expensive, slow, and oddly fragmented for something that sits at the center of modern biologics development. If you have worked in or around pharma R&D, or you have backed any company in the biologics stack, you already know the general shape of the problem. Designing novel antibody candidates from scratch, or even optimizing existing ones against a target structure, typically takes a year or more from initial design to meaningful wet-lab data. The cost per drug entering clinical development runs somewhere north of a billion dollars when you account for failure rates. The industry has known for years that a process that relies this heavily on manual iteration, siloed CRO handoffs, and the bandwidth of a thin layer of highly specialized computational biologists was going to crack at some point.

The crack accelerated around 2020, which is when the generative AI wave started catching up to protein structure prediction work that had been building since AlphaFold. Once you could predict protein folding with reasonable accuracy and then start asking generative models to suggest sequences with better binding characteristics, the number of potential drug-discovery models exploded fast. As Rajiv Chopra, VP of Healthcare AI and Life Sciences at AWS, put it when announcing the platform, the rapid proliferation of drug-discovery models turned computational biologists into a genuine bottleneck. You had the models, but translating research goals into multi-step machine learning pipelines required a skill set that most wet-lab scientists simply do not have and that most institutions do not have enough of. The dream was always getting biologists closer to the compute without requiring them to become ML engineers in the process.

By early 2026, the market had arrived at a peculiar place. There were over 200 AI-designed drug candidates in clinical development globally. The first AI-designed approval was expected somewhere between 2026 and 2027. BCG, McKinsey, and Deloitte had all published forecasts calling for pharma AI R&D budgets to increase 75 to 85 percent over 2025 levels. A drug that would have cost $100 to $200 million and six to eight years of traditional discovery work was getting done computationally for around $6 million in 18 months in select cases. The economics of shots on goal were shifting dramatically. And yet, the toolchain was still a mess. Models lived in one place. Compute lived somewhere else. CRO wet-lab partners had their own bespoke integrations and pricing structures. Institutional knowledge from each experiment was getting lost rather than compounded. Into this comes Amazon Bio Discovery, announced April 15, 2026, which is today.

What Amazon Bio Discovery Actually Is

Read more

- RFK Jr. announced on Feb 27, 2026 (JRE #2461) that ~14 of the 19 peptides the FDA shoved into Category 2 in Sept 2023 would be reclassified back to Category 1.

- As of April 2026, zero of that has hit the Federal Register. Five peptides (CJC-1295, Ipamorelin, Thymosin Alpha-1, AOD-9604, Selank) got yanked from Cat 2 in Sept 2024 and referred to PCAC. PCAC reviewed them on 10/29/24 and 12/4/24 and mostly voted AGAINST 503A bulks list inclusion.

- The actual legal mechanism: nominator withdraws > FDA can still refer to PCAC > PCAC non-binding vote > FDA publishes 503A bulks list update > Federal Register notice. Nothing binding until step 4.

- Next live catalyst: July 2026 PCAC meeting reviewing a larger batch of peptides (the “12 peptides” referenced in the Kennedy post).

- Market context: U.S. compounding pharmacy TAM ~$6.57B in 2024, 503A ~73% share. Compounded GLP-1 slice alone projected $6–8B/yr at peak. Peptide-specific gray market estimated ~$328M in 2025. Peptide therapeutics projected $49.7B globally in 2026.

- 1,000+ adverse events reported on compounded GLP-1s by mid-2025. BPC-157 flagged for immunogenicity risk. ~8% of “research use only” peptide samples tested show endotoxin contamination.

- The investable asks: (1) who owns the API supply chain for peptides crossing back to Cat 1, (2) who owns the telehealth + med-spa dispensing rails, (3) who wins on quality signal (503B outsourcing facilities w/ cGMP), (4) who gets squeezed (brand-name manufacturers w/ overlapping indications, gray-market importers).

- Bottom line: The Kennedy post is a policy signaling event, not a rule change. The edge is in reading the PCAC calendar, the docket (FDA-2015-N-3534, FDA-2015-N-3469), and the peptide-by-peptide scientific objections, not the Rogan clip.

Table of Contents

- Part 1: The post, the podcast, and why Feb 27 matters more for calendars than for law

- Part 2: What Category 2 actually is, and why compounding pharmacy people lost their minds in Sept 2023

- Part 3: The withdraw-then-refer trick, and why it is not new

- Part 4: PCAC’s Oct and Dec 2024 votes, and the uncomfortable scoreboard

- Part 5: The peptide list, graded by PCAC survivability

- Part 6: The compounding pharmacy stack, post-GLP-1 unwind

- Part 7: The gray market problem, and why quality signal is the real moat

- Part 8: Where angel and seed checks actually compound from here

- Part 9: What to watch between April and Q4 2026

- Part 10: The honest caveats

Part 1: The post, the podcast, and why Feb 27 matters more for calendars than for law

On Feb 27, 2026, Kennedy went on Rogan (JRE #2461) and told the audience that roughly fourteen peptides were coming back. Within 72 hours every longevity clinic Twitter account, every peptide vendor running a Shopify store, and every compounding pharmacy sales rep had pushed the same screenshot. The tweet he posted the next day was more specific: twelve peptides, withdrawn nominations, restoration of access “within weeks.”

“Within weeks” is doing a lot of work in that sentence. As of mid-April 2026, the FDA has not published a Federal Register notice modifying the 503A bulks list. The Category 2 list has not been formally revised. No statutory change has passed Congress. LumaLex and Buchanan Ingersoll (among the more sober compounding-law shops) both published essentially the same analysis: the policy direction is real, the rulemaking is not.

So what actually happened? Three things, and it is worth separating them because confusing the three is where most operators lose money.

First, on Sept 20, 2024, the FDA formally removed five peptides from Category 2: CJC-1295, Ipamorelin acetate, Thymosin Alpha-1, AOD-9604, and Selank acetate. The trigger was that the original nominators withdrew their nominations. Withdrawal does not equal approval. Removal from Cat 2 means the peptide is no longer actively flagged as a safety concern under interim policy, but it still cannot be compounded under 503A unless it appears on the bulks list, has a USP monograph, or is the active ingredient in an FDA-approved drug. None of which applies to these five.

Second, PCAC (the Pharmacy Compounding Advisory Committee) actually convened and voted. Oct 29, 2024 covered Ipamorelin, Ibutamoren, and Kisspeptin-10. Dec 4, 2024 covered CJC-1295, Thymosin Alpha-1 (acetate and free base), and AOD-9604. The committee voted against recommending most of them for the 503A bulks list. That vote is non-binding, but historically the FDA follows PCAC recs maybe 80%+ of the time. This is the part of the timeline that does not appear in any of the LinkedIn posts about “peptides are back.”

Third, Kennedy’s Feb 27 announcement reflects a political intent to override or reroute the PCAC outcome. That is the actual news. The administration is signaling it wants the FDA to apply a different safety-signal standard and move a larger basket of peptides through the pipeline in one go, with the July 2026 PCAC as the next formal forum.

The Rogan clip did one useful thing for investors: it set a date-certain for a catalyst. The July PCAC meeting now has attention on it that it would not otherwise have had.

Part 2: What Category 2 actually is, and why compounding pharmacy people lost their minds in Sept 2023

Quick refresher, because the category system is bad at being self-explanatory. Under the Drug Quality and Security Act of 2013 (the meningitis-outbreak law), compounding happens in two lanes: 503A (traditional pharmacy, patient-specific Rx, state-board oversight, no cGMP, no FDA approval required) and 503B (outsourcing facility, bulk production without patient-specific Rx, FDA-registered, cGMP-compliant).

Inside 503A, a pharmacy can compound a substance if one of three conditions holds: the substance has a USP or NF monograph, it is the active ingredient in an FDA-approved drug, or it appears on the 503A bulks list. Most peptides satisfy none of those. To get on the bulks list, someone has to nominate the substance, FDA evaluates it on four criteria (physicochemical characterization, safety, effectiveness evidence, historical use in compounding), PCAC reviews and votes, then FDA publishes a final rule.

While all that is happening, the FDA sorts nominated substances into interim buckets. Category 1 means “under evaluation, no significant safety risk identified, enforcement discretion applies.” Category 2 means “potential safety concerns identified, no enforcement discretion, do not compound this.” There is technically a Category 3 for procedurally disqualified nominations. For practical purposes, Cat 1 = green light, Cat 2 = red light.

On Sept 29, 2023, FDA dropped nineteen peptides into Category 2 in a single move. Overnight, BPC-157, TB-500, CJC-1295, Ipamorelin, AOD-9604, Thymosin Alpha-1, GHK-Cu, Semax, Selank, KPV, MOTS-c, Epitalon, LL-37, Melanotan II, Kisspeptin-10, GHRP-2, GHRP-6, PEG-MGF, and DSIP became effectively uncompoundable. A multi-hundred-million-dollar slice of the compounding pharmacy business went dark in a week.

The stated reasons on the FDA side were consistent across the briefing docs: immunogenicity risk (peptides can trigger anti-drug antibodies, especially with repeated injection), manufacturing impurity concerns (peptide synthesis is notoriously sensitive to endotoxin contamination, truncated sequences, and diastereomers), and lack of robust human clinical data. The last one is the most honest. For most of these molecules, the human evidence base is a few small case series, a handful of underpowered trials conducted outside the U.S., and a lot of anecdotal reporting from longevity clinics.

The industry response was about what you would expect. The Outsourcing Facilities Association and a handful of 503A plaintiffs filed suit. At least one of those suits settled, with the FDA agreeing to route the contested peptides through PCAC rather than leave them stranded in Cat 2 indefinitely. That settlement is the quiet reason five peptides moved in Sept 2024. It was not benevolence. It was litigation.

Part 3: The withdraw-then-refer trick, and why it is not new

The mechanism Kennedy references, nominators withdrawing nominations and FDA responding by moving the substance from Cat 2 to PCAC review, is not a novel maneuver. Read the Oct 2024 and Dec 2024 PCAC briefing books and the pattern jumps off the page.

Here is what actually happens. A nominator (usually a compounding pharmacy trade group or a specialty API supplier) submits a nomination for inclusion on the 503A bulks list via the public docket (FDA-2015-N-3534 for 503A, FDA-2015-N-3469 for 503B). FDA reviews, finds gaps in the safety or efficacy data, and proposes Cat 2 status. The nominator then has a choice: withdraw, supplement with more data, or let FDA propose adverse action.

If the nominator withdraws, FDA has two options. It can let the substance fall out of the active process entirely (in which case it cannot be compounded under 503A regardless, because it still does not appear on the bulks list). Or it can elect to proceed to PCAC review on its own initiative. The Dec 2024 briefing document explicitly says “this nomination was withdrawn, however, FDA is electing to proceed to PCAC review,” for multiple peptides.

Why would FDA proceed after withdrawal? Usually because the substance has enough clinical traction, public attention, or regulatory pressure that a definitive PCAC record is useful. A PCAC “no” vote is easier to defend in future litigation than an abandoned nomination with no record.

What is new in 2026 is not the mechanism. It is the batching. Kennedy is signaling that twelve peptides will run through this process more or less simultaneously, with the July 2026 PCAC as the forum. That is procedurally unusual but not unprecedented. The political theater around it (HHS Secretary, Rogan, coordinated clinic marketing) is what is actually new.

For anyone underwriting a deal in this space, the takeaway is that the procedural path is well-defined and slow. Even under a maximally favorable PCAC outcome in July, a final Federal Register notice updating the bulks list typically trails the advisory vote by four to nine months. Full rulemaking with notice and comment can push that to twelve to eighteen months. The clinics running ads saying “peptides are back, order today” are, at best, overselling the timeline by two to three quarters.

Part 4: PCAC’s Oct and Dec 2024 votes, and the uncomfortable scoreboard

The Oct and Dec 2024 PCAC meetings are the part everyone glosses over, because the results are inconvenient for the bull case.

October 29, 2024: Ipamorelin, Ibutamoren, and Kisspeptin-10. FDA came in with the default recommendation of “not include on 503A bulks list.” PCAC voted against inclusion for most of these. The stated concerns were the usual suspects: insufficient human safety data, mechanistic concerns about unintended endocrine effects, and a lack of reproducible efficacy data outside of small or open-label trials.

December 4, 2024: CJC-1295, Thymosin Alpha-1 (acetate and free base), and AOD-9604. Same structural outcome. PCAC voted against inclusion. The Thymosin Alpha-1 discussion is worth flagging because it has the strongest human clinical evidence of any molecule on the list. It has been used clinically in over 35 countries. It has published data in hepatitis, sepsis-adjacent indications, and immune reconstitution. And it still got voted down, largely because the committee concluded the U.S. evidence base was not equivalent to international use.

The implication for the Feb 2026 announcement is uncomfortable. Kennedy is proposing to reclassify peptides that the actual scientific advisory committee, hearing sworn expert testimony and reviewing the safety data packages, voted against less than fifteen months ago. One of two things has to happen for the political timeline to hold: (a) the PCAC panel gets reconstituted with members more sympathetic to the regulatory-arbitrage view (which has partially happened already; the PCAC membership was adjusted in 2025), or (b) the FDA bypasses PCAC recommendations and issues a final rule contrary to the advisory vote. Option (b) is legally possible but historically rare and invites immediate litigation from patient-safety groups and brand manufacturers.

The smart money is underwriting option (a) with a haircut. Assume PCAC gets more sympathetic, assume the July 2026 vote is closer to 50/50 than the 2024 votes, and assume FDA issues a split decision: maybe five to seven peptides get reclassified to Cat 1, the rest stay in Cat 2 with specific safety objections documented. That is a materially different outcome from “14 peptides are back,” and it matters a lot for anyone running inventory forecasts on an API purchase order.

Part 5: The peptide list, graded by PCAC survivability

Here is the rough-cut handicap, based on the briefing docs, the 2024 PCAC votes, and the public safety record. This is not investment advice and the list will move with the July 2026 docket. Grades are a subjective read of primary objections.

Likely to clear, with caveats. Thymosin Alpha-1 has the strongest international clinical record. The 2024 no-vote was about U.S. evidence, not mechanistic concern. A cleaner data package could flip it. AOD-9604 has a relatively clean safety profile and was originally developed as an anti-obesity agent that made it through Phase 2 before being dropped for commercial rather than safety reasons. GHK-Cu has decades of topical cosmetic use and a reasonable safety record, though the injectable use case is less well-characterized. Selank has Russian clinical use but limited U.S. data, and may clear on historical-use grounds alone.

Contested middle. BPC-157 is the most-demanded molecule on the list and the most likely to attract a political push, but FDA has specifically flagged immunogenicity risk, and the evidence base is almost entirely animal (rat tendon models, rat GI models) with very limited human data. The FDA’s objection here is concrete and hard to rebut without new clinical data, which nobody has generated because the market has been running on compounded product. TB-500 / Thymosin Beta-4 has similar issues. CJC-1295 and Ipamorelin already got voted down; they would need a reconstituted panel or new data to clear. KPV and MOTS-c are niche enough that they may clear on “nobody is hurt by these” grounds, but the efficacy data is genuinely thin.

Unlikely to clear. Melanotan II has real cardiovascular signals, nausea, and the melanoma-adjacent cosmetic use case, which makes FDA uniquely hostile. GHRP-2 and GHRP-6 have complex side effect profiles (cortisol and prolactin elevation, strong appetite stimulation). DSIP and Epitalon have essentially no rigorous clinical data. LL-37 has mechanistic concerns related to its role in autoimmunity. Kisspeptin-10 has endocrine effects that make FDA nervous in a general-population compounding context.

Semax is the wildcard. Strong Russian evidence, interesting nootropic claims, and a defensible safety record, but almost no U.S. data. Could go either way on the July docket.

The practical upshot for an angel deciding whether to write a check into a peptide-adjacent startup: if the business model requires BPC-157 or TB-500 to be legally compounded at scale in the U.S. inside the next 18 months, haircut that assumption hard. If the business model works at a subset of five to seven peptides clearing, there is an actual opportunity.

Part 6: The compounding pharmacy stack, post-GLP-1 unwind

Context matters here, and the GLP-1 unwind is the closest analogue to what is about to happen with peptides. Both show how fast compounding pharmacy economics can flip.

The U.S. compounding pharmacy market was ~$6.57B in 2024 across all therapeutic areas, with 503A representing roughly 73% of revenue. At peak GLP-1 shortage, compounded semaglutide and tirzepatide represented $6–8B of annualized revenue, with roughly 4–5M compounded Rx per year by some estimates. Then FDA declared the shortages resolved (tirzepatide in Dec 2024, semaglutide in Feb 2025), the 503B wind-down hit in May 2025, and the 503A guidance tightened shortly after.

What happened next is instructive. The 503B facilities mostly exited GLP-1 compounding (under court order). The 503A pharmacies pivoted to the “clinical difference” exemption, which lets them compound technically-not-a-copy versions (different concentrations, added B12, peptide cocktails, microdose protocols). FDA sent a wave of warning letters. State boards got overwhelmed. Several telehealth platforms lost distribution relationships. Manufacturer cease-and-desist letters multiplied. The gray market for “research-use-only” peptides (including non-GLP-1 peptides) filled part of the gap.

The adverse event count on compounded GLP-1s crossed 1,000 by mid-2025. That is the number the FDA keeps pointing at in rulemaking. For context, brand-name semaglutide generated 8,000+ adverse events in 2023 alone per FAERS, on a much larger prescription base, but the per-prescription rate comparison is not clean because compounded AE reporting is patchier.

The peptide reclassification, if it happens, would ride on top of that compounding stack. The players who survived the GLP-1 unwind with their licenses intact (Empower, Hallandale, Olympia, a handful of regional 503Bs) are the ones positioned to catch peptide volume. New entrants face a brutal barriers-to-entry problem: 503B registration takes 18–24 months, state 503A licenses are a patchwork, and cGMP compliance is expensive.

The angel-check question is whether the peptide wave creates room for a new vertical compounder, or whether the existing platforms soak up all the volume. The historical evidence says the incumbents win because they have the API supplier relationships, the state licenses, and the pharmacist relationships with the prescribing clinics. A new entrant needs a differentiator that is not just “we compound peptides too.” The interesting angles are on the verification layer (COA aggregation, independent lot testing, supply chain traceability) and on the prescriber software layer (protocol libraries, dosing calculators, compliance documentation).

Part 7: The gray market problem, and why quality signal is the real moat

PeptiDex pegged the gray market for imported peptides at roughly $328M in 2025, and U.S. peptide search volume hit 10.1M queries per month by Jan 2026. Independent testing of “research-use-only” peptide samples found endotoxin contamination in approximately 8% of samples across vendors, with a smaller but nontrivial share containing none of the labeled compound.

That is the actual market reality the Kennedy announcement is trying to address. Demand did not disappear when FDA put peptides in Cat 2. It migrated. Patients who were getting physician-supervised Thymosin Alpha-1 at a legitimate compounding pharmacy in Sept 2023 were, by mid-2024, ordering Chinese-origin product from websites with “research purposes only” disclaimers. Contamination rates went up. Dosing errors went up. Downstream adverse events went up. The FDA ended up with worse safety outcomes, not better.

That is the political argument Kennedy is leaning on, and it is not a bad one. The counterargument, which the FDA career staff makes in briefing docs, is that legitimizing compounding does not solve the contamination problem unless the bulks API supply chain is cleaned up in parallel. Compounded product is only as safe as the API that goes in.

For investors, this is where the interesting structural bet is. Assuming some peptides clear to Cat 1, the new binding constraint becomes API quality. There are a handful of FDA-registered bulk API manufacturers capable of producing pharmaceutical-grade peptides (Bachem, Polypeptide, CordenPharma, Auspep, and a few specialty players). Most U.S. compounding is currently running on imported API from Chinese suppliers with uneven USP compliance and variable COA quality.

If a peptide gets 503A-eligible, the compounding pharmacy is required to source from an FDA-registered API manufacturer with documented cGMP compliance. That constraint immediately prices out a chunk of the current gray-market API supply. The surviving suppliers get pricing power. The downstream consequence is that legitimate compounded peptides will land at roughly $150–400 per month retail, which is 3–8x the gray market price but still materially cheaper than most branded alternatives (where one exists).

That is a pricing environment where a quality-signal brand matters. “Sourced from FDA-registered facility, lot-specific potency and sterility testing, cGMP-compliant fill/finish” becomes a differentiator the prescriber can point to. For a startup building in this space, owning the quality signal is probably a more defensible position than owning the distribution.

Part 8: Where angel and seed checks actually compound from here

Running through the zones where capital can meaningfully move the needle in the next 18 months, with the understanding that all of this is contingent on FDA actually publishing something:

API verification and lot traceability. Every compounding pharmacy is going to need defensible documentation on where their peptide API comes from, what the COA shows, and whether the lot passes independent potency and endotoxin testing. The current workflow is manual, PDF-based, and error-prone. A SaaS layer that sits between the API supplier, the pharmacy, and the prescriber, handling COA intake, anomaly detection, and audit trail, has a clear buyer (the pharmacy operator, because state board audits are getting more aggressive) and a clear wedge (existing tools are terrible). The problem is that the TAM is narrower than it looks; there are maybe 3,000–5,000 compounding pharmacies nationally, and only a subset will touch peptides.

Prescriber-facing protocol and compliance tools. The med spa and longevity clinic operator has a real problem: keeping track of which peptides are legally compoundable in which states, for which indications, with what documentation, under what insurance posture. A vertical EHR + protocol library + e-prescribing workflow that handles the state-by-state variance, the “clinical difference” documentation, and the informed consent language is a genuinely useful product. Spruce, Akute, and a few others have nibbled at the edges here, but nobody has nailed the peptide-specific workflow. This is probably the highest-probability investable zone.

Telehealth distribution platforms. The incumbents (Hims, Ro, Noom, LifeMD) have the brand, the CAC machinery, and the prescriber network. A pure-peptide DTC entrant faces brutal CAC economics unless it can cross-sell from an adjacent indication. The more interesting model is a B2B play: a platform that powers the independent longevity clinic’s telehealth stack, letting a single-location operator offer the same digital intake and follow-up experience as a national brand without building it themselves.

503B outsourcing facility consolidation. There are roughly 70–80 FDA-registered 503B outsourcing facilities. Many of them are undercapitalized family businesses that got squeezed by the GLP-1 unwind. If peptides come back at scale, cGMP-compliant sterile fill capacity becomes a constraint. A roll-up play in 503B sterile compounding, capitalized to $50–100M, is not an angel check, but the ancillary businesses (QA software, environmental monitoring, sterility assurance, BUD extension studies) are all angel-checkable. This is also the quietest part of the market and the one where operators with actual pharmacy experience have a massive information edge over generalist investors.

Peptide-specific clinical evidence generation. The honest bull case for long-term peptide market expansion is that someone eventually runs the Phase 2/3 trials that FDA keeps saying are missing. A CRO or investor-backed platform that runs well-designed real-world-evidence studies or small RCTs on the highest-demand peptides (BPC-157 in tendon repair, Thymosin Alpha-1 in immunocompromised populations, KPV in IBD) could generate the data package that flips the next PCAC cycle. This is a longer-horizon, harder-to-underwrite bet, but it is the one that actually moves the category out of the compounding gray zone and into a normal drug approval track.

Testing and COA aggregation as a consumer-facing brand. There is a plausible “Carfax for compounded peptides” play where the end patient can verify their specific lot, see third-party testing results, and confirm the pharmacy’s license status. This is consumer-grade trust infrastructure in a category that desperately needs it. The hard part is distribution; the easy part is building the product.

Part 9: What to watch between April and Q4 2026

A short list of catalysts that will actually move primary-source documents and therefore reprice assumptions:

Before July, watch the FDA docket (FDA-2015-N-3534 and FDA-2015-N-3469) for briefing book postings. Historically these drop 30–45 days before the PCAC meeting. The briefing books will tell you which peptides are on the July agenda, which form (acetate vs free base) is being evaluated, and what safety objections FDA is leading with. That is the real information.

Watch the Federal Register for any interim guidance from FDA on the 503A bulks evaluation process. An interim guidance that loosens the “significant safety risk” threshold for Cat 2 designation would be a much bigger deal than any specific peptide reclassification.

Watch the PCAC membership. Additions to the committee in 2025 reshuffled the balance of perspectives. Additional changes before the July meeting would be a strong leading indicator of where the votes are heading.

Watch the 503B outsourcing facility filings. If the handful of cGMP-compliant 503Bs start filing for additional product capabilities that cover peptide APIs, that is a signal they expect volume. These filings are public via FDA’s 503B registration database.

Watch for litigation. If the Feb 2026 announcement gets translated into an administrative action that bypasses PCAC or Federal Register rulemaking, expect lawsuits from patient safety groups or from brand manufacturers with overlapping indications (Lilly and Novo have already shown they will sue, and they have competent plaintiff’s counsel). Litigation would delay the effective date by 6–18 months.

Watch state pharmacy boards. Even if federal reclassification happens, states can and do impose tighter requirements. California, Texas, Florida, and New York are the four markets that matter. State-level guidance can lag or lead federal action by quarters.

Watch the adverse event count. If the compounded peptide AE count spikes as volumes pick up, expect FDA to reverse or pause. The political cost of a few high-profile harm incidents could crater the entire trajectory in a news cycle.

Part 10: The honest caveats

Nothing in this essay is legal or financial advice. The author is not a lawyer, not a regulatory affairs professional, and not an actual compounding pharmacist. If you are an operator making inventory purchasing decisions, call your regulatory counsel. If you are an investor sizing a position, build your own regulatory probability model rather than borrowing anyone else’s.

The peptide category has a long history of overpromising and underdelivering on both the clinical side and the regulatory side. BPC-157 in particular has been “three months from reclassification” for approximately four years running. Each cycle draws in a new wave of operators who get blown up on the next FDA pivot. The Feb 2026 announcement is the most credible signal the category has had, but “most credible” is grading on a curve.

There is also a real safety argument that does not get enough airtime in the enthusiast circles. Peptide injections, even the well-studied ones, do not have the kind of controlled-trial safety data that pharmaceutical investors are used to. Immunogenicity, contamination risk, and off-target effects are not paranoid concerns. They are concerns that killed the nominations in the first place, and they will not disappear because the political wind shifts. The investor who underwrites the most aggressive bull case on peptides should think carefully about what happens if two or three high-profile adverse events hit in the back half of 2026.

The best version of this story is that the policy environment settles into a stable middle ground, where five to seven of the better-characterized peptides clear to Cat 1, the API supply chain tightens up around FDA-registered manufacturers, compounding pharmacies offer legitimate prescriber-supervised access at moderate price points, the gray market shrinks, and a few actual clinical trials get run on the higher-demand molecules. That outcome is good for patients, good for legitimate operators, and good for the handful of investors who position around the middle of the fairway rather than the tails.

The worst version is a chaotic reclassification followed by safety incidents, followed by reversal, followed by a worse gray market than before. That outcome is possible too, and the timeline between those two scenarios is maybe 18 months either way.

The Kennedy post is not a rule. The July 2026 PCAC is not a guarantee. The twelve peptides on the list are not a unified basket; they will split across the safety and efficacy spectrum the same way they did in Dec 2024. Read the briefing books. Read the dockets. Talk to a compounding pharmacist who has actually lived through a PCAC cycle. The edge in this category is not in the tweet. It is in the paperwork nobody wants to read.​​​​​​​​​​​​​​​​

Background: The Regulatory Arc from 2020 to 2026

What FHIR Endpoints Actually Are and Why They Matter Here

The Drug PA Extension: Scope, Timeline, and Technical Requirements

HIPAA Administrative Simplification: The Big Structural Shift

API Endpoint Reporting: The Infrastructure Registry Play

Decision Timeframes and Denial Transparency

Prior Authorization Metrics: The Public Accountability Layer

RFIs Worth Watching: ADT, Cybersecurity, Step Therapy

Investment Themes and Build Opportunities

Conclusion: The Regulatory Arbitrage Case

Abstract

CMS released CMS-0062-P on April 10, 2026, a proposed rule that extends prior authorization interoperability requirements to drugs for the first time, mandates FHIR-based API endpoint reporting, proposes FHIR as the HIPAA standard for PA-related transactions, and tightens decision timeframes across MA, Medicaid, CHIP, and QHP programs. Key dates and numbers:

- Comment deadline: June 15, 2026

- Compliance target for most proposals: October 1, 2027

- Drug PA timeframes proposed: 24 hours (Medicaid/CHIP drugs), 72 hours standard / 24 hours expedited (QHPs)

- Required IGs include CARIN Blue Button 2.2.0, Da Vinci PDex 2.1.0, CRD 2.2.1, DTR 2.2.0, PAS 2.2.1

- Old IG versions (STU 2 era) proposed to expire January 1, 2028

- Builds on 2020 interoperability final rule and 2024 PA final rule

- New coverage: small group market QHP issuers on FF-SHOPs added as impacted payers

Background: The Regulatory Arc from 2020 to 2026

To understand why CMS-0062-P matters, you have to understand where it sits in a multi-year regulatory campaign that started in earnest in 2020. The 2020 CMS Interoperability and Patient Access Final Rule (CMS-9115-F) was the opening salvo. It told Medicare Advantage plans, Medicaid, CHIP, and qualified health plan issuers that they had to build and maintain FHIR-based APIs for patient access, provider directories, payer-to-payer data exchange, and eventually prior authorization. The mandate was a structural shock to an industry that had grown comfortable with X12 EDI transactions, fax-based PA workflows, and the general opacity of payer administrative systems.

Then came the 2024 CMS Interoperability and Prior Authorization Final Rule, which went further and required actual electronic prior authorization support for non-drug items and services, with decision timeframe mandates and public reporting obligations for PA metrics. That rule gave the industry a taste of what FHIR-native PA workflows look like in practice, at least for the medical side of the house. Drugs were conspicuously left out, which everyone in the industry noticed and fully expected would be addressed in subsequent rulemaking.

CMS-0062-P is that subsequent rulemaking. It closes the drug PA gap, extends the IG requirement stack, adds an entirely new mandatory FHIR endpoint registry, and layers HIPAA administrative simplification proposals on top of all of it. The cumulative effect is a regulatory architecture that, when fully implemented, would make FHIR-based interoperability the legal floor for how prior authorization works in America rather than just a best practice or a pilot.

For health tech founders and early-stage investors, this is not just regulatory background noise. This is the demand signal. Every compliance obligation in this rule is a vendor opportunity somewhere in the stack. The question is where the real money is and who is positioned to capture it.

What FHIR Endpoints Actually Are and Why They Matter Here

Read more

Two FDA draft guidances published in February and April 2026 represent the most significant structural shift in gene therapy regulation in over two decades. The Plausible Mechanism Framework (PMF) guidance from CBER and CDER creates a novel approval pathway for individualized therapies targeting ultra-rare genetic diseases where traditional RCTs aren’t feasible. The companion NGS safety guidance published April 14, 2026 operationalizes the genomic safety assessment requirements for GE products. Together, these create a coordinated regulatory architecture that has real implications for capital allocation, deal structuring, and founder strategy in health tech.

Key takeaways for the impatient:

- FDA now formally acknowledges single-patient and ultra-small-cohort studies can support marketing approval

- The “plausible mechanism” standard lets sponsors leverage mechanistic data and natural history as confirmatory evidence, replacing or supplementing traditional clinical endpoints

- Genome editing products can now bundle multiple mutation-targeting variants under a single IND/BLA

- NGS-based off-target analysis is now explicitly required pre-IND, with detailed methodology specs

- Both traditional and accelerated approval pathways remain available; the framework doesn’t mandate one

- This is a DOGE-era deregulatory signal with real scientific teeth, not just politics

Table of Contents

1. Why This Matters Right Now

2. The Plausible Mechanism Framework: What It Actually Says

3. The Clinical Evidence Problem It Solves (and Doesn’t)

4. CMC and Manufacturing Flexibility for Founders

5. The NGS Safety Guidance: What It Requires

6. Off-Target Analysis: The New Baseline

7. What This Means for Investors and Founders

8. The Regulatory Arbitrage Angle

9. Risks and Open Questions

Why This Matters Right Now

There are a lot of FDA guidance documents that get published every year and most of them don’t move the needle on anything. This one is different. In February 2026, FDA published the Plausible Mechanism Framework guidance for individualized therapies targeting specific genetic conditions with known biological cause. Two months later on April 14, 2026, FDA dropped the companion piece: a detailed draft guidance on NGS-based safety assessment for genome editing products. Commissioner Marty Makary called it a “forward approach to drive innovation” and CBER director Vinay Prasad described it as “revolutionary advance in regulatory science” in the press releases. That kind of language from FDA leadership doesn’t happen often and it’s worth taking seriously.

The broader context here is worth understanding before getting into the weeds. The Trump administration came in with an explicit deregulatory mandate and RFK Jr. at HHS has been vocal about cutting red tape in drug approval. Some of the deregulatory moves in health policy over the past year have been driven more by ideology than science. This one is actually different. The Plausible Mechanism Framework has been in development for years at FDA and reflects real scientific evolution in the field, specifically the growing maturity of CRISPR-based editing, ASO therapeutics, and next-gen sequencing tools that make it technically feasible to characterize individualized therapies with rigor even without large patient cohorts. The political winds accelerated the publication timeline, but the underlying science is solid. That combination of regulatory momentum plus scientific readiness is exactly the kind of setup health tech investors should be paying attention to.

To understand why this is significant, it helps to have a mental model of what the rare disease therapeutic development problem actually looks like. There are roughly 7,000 known rare diseases. Around 95 percent of them have no approved treatment. A large fraction of those are monogenic diseases with clearly identified pathogenic variants. For some of these conditions, the affected patient population might be a few hundred people globally, or fewer. In some cases it’s literally one child. The traditional drug approval pathway requires substantial evidence of effectiveness, which FDA has historically interpreted as requiring at least one adequate and well-controlled clinical investigation. That standard was developed for drugs treating large patient populations where you can enroll hundreds or thousands of subjects, randomize them, and power your study to detect statistically meaningful effects. It makes no sense applied to a disease affecting twelve people on the planet.

The Plausible Mechanism Framework: What It Actually Says

The PMF guidance is a long document with a lot of regulatory boilerplate, but the core intellectual contribution is relatively clean. FDA is formalizing a framework under which a drug or biologic can receive marketing approval based on a well-characterized mechanism of action, natural history data as external control, and confirmation that the therapy actually engaged its target, even when clinical evidence comes from a very small number of patients, potentially just one.

The five elements FDA identifies as constituting the plausible mechanism framework are worth stating precisely because the details matter for how you’d structure a development program around this. First, there needs to be a specific genetic, cellular, or molecular abnormality with a clear connection to the disease. Second, the therapy has to target the underlying or proximate pathogenic biological alterations, not just downstream symptoms. Third, you need a well-characterized natural history of the disease in untreated patients. Fourth, you need to confirm that the target was successfully drugged or edited. Fifth, you need to demonstrate improvement in clinical outcomes or course. That fifth element is where FDA has built in meaningful flexibility: “improvement” can be assessed against the natural history baseline rather than a contemporaneous control group, and in some cases surrogate endpoints or biomarkers can substitute for direct clinical benefit measures.

The guidance explicitly states that FDA anticipates substantial evidence of effectiveness for individualized therapies could be established based on a single adequate and well-controlled clinical investigation with confirmatory evidence. That’s the key sentence. It’s not new regulatory authority, FDA already had this, but it’s the first time the agency has put out a comprehensive framework explaining how they’ll apply existing standards to this class of products. The confirmatory evidence can come from mechanistic or pharmacodynamic data, confirmation of target engagement from nonclinical or clinical studies, or exposure-response relationships on biomarkers and clinical outcomes. That’s a dramatically wider definition of “confirmatory evidence” than what’s been operationally applied historically.

One of the more interesting structural innovations in the PMF guidance is the treatment of genome editing products with multiple variants. The guidance explicitly acknowledges that GE technologies are modular, meaning a CRISPR product can be thought of as composed of components, an editor protein, a guide RNA, a delivery vector, that can be modified somewhat independently. If a product is designed to correct different mutations within a single gene by swapping out the gRNA, FDA is saying those product variants can be included under a single IND and BLA. Clinical data from a defined set of mutations can support licensure of the platform, and a highly supported plausible mechanism of action can then be used to support adding new variant targets that weren’t in the original trial. This is potentially massive for platform-based gene therapy companies because it means you don’t need a separate approval for every mutation you can correct, you just need to demonstrate the editing activity and off-target risk profile for each new variant. The precedent this sets for scalable rare disease platforms is significant.

The Clinical Evidence Problem It Solves (and Doesn’t)

Let’s be real about what the PMF guidance solves and where the hard problems remain. The framework creates a viable regulatory path for the development of individualized therapies in ultra-small patient populations. That’s genuinely new and important. But it doesn’t make drug development easy or cheap, and it doesn’t eliminate the need for rigorous scientific work. What it does is change the nature of what rigorous looks like for this class of products.

The guidance is pretty direct about the fact that early planning is critical. Specifically, it recommends that sponsors initiate an observational protocol to collect baseline data as soon as potential study participants are identified, before manufacturing and nonclinical work is even complete. The idea is to pilot clinical outcome assessments, identify disease-relevant biomarkers, establish a lead-in baseline, and characterize disease trajectory during the time you’d otherwise be waiting around anyway. For investors, this is a hint about what early-stage development programs should look like: natural history data collection is not an afterthought, it’s a core asset that needs to be built in from day one.

The guidance also has a useful reminder about what makes an externally controlled trial credible. The natural history of the disease in the untreated population has to be well-characterized enough to distinguish a treatment effect from natural variability in the phenotype. For diseases with a highly variable or episodic course, FDA says they’ll consider longer follow-up durations or surrogate endpoint strategies. For diseases where the untreated natural history is essentially a well-defined decline to death or severe disability, the evidentiary bar for demonstrating that a treated patient is doing better than expected can actually be relatively low. Think about a disease where every untreated child is profoundly disabled by age two. If your ASO therapy results in a child reaching developmental milestones that no untreated child in the natural history literature has ever reached, that’s a pretty compelling case even without a contemporaneous control. FDA is essentially saying they’ll evaluate that kind of evidence on its merits.

What the PMF guidance does not solve is the manufacturing problem, the commercial problem, or the cost problem. Making an individualized therapy, one literally designed around a single patient’s mutation, is extraordinarily expensive. The guidance nods to this by noting that CMC development needs to happen concurrently with clinical development, and that sponsors should leverage prior manufacturing knowledge wherever possible to support validation and shelf life. But the per-patient economics of truly individualized GE or ASO products remain brutal. The guidance is realistic about this: it’s not a commercial scalability framework, it’s an approval framework. Figuring out reimbursement and manufacturing economics is left to others.

CMC and Manufacturing Flexibility for Founders

The CMC section of the PMF guidance is actually one of the more practically useful parts for founders building in this space. FDA is explicit about several areas where it intends to exercise flexibility, and knowing those going in can save meaningful time and money.

The guidance acknowledges that because the number of batches expected to be manufactured for individualized therapies is small, there are specific challenges around process validation and shelf-life determination that require adaptive strategies. Prior manufacturing knowledge from related products can be leveraged to support process validation of a similar product at the same manufacturing site. For GE products with drug product variants, CMC information including process performance qualification data can be shared across variants. This is directly connected to the platform licensing point above. If you’ve already done validation work for one gRNA variant, you don’t necessarily start from scratch for the next one.

On analytical methods, the guidance says that methods already qualified or validated for a closely related product may be appropriate with a suitability evaluation focused on product differences. That’s meaningful because method validation is time-consuming and expensive. The ability to bridge from an existing validated method to a new product variant rather than validating from scratch is a real cost and timeline advantage.

For shelf life, the guidance encourages sponsors to develop a strategy early in development and to leverage related product data to support the proposed shelf life. The implicit message for founders is: don’t treat these as separate problems to be solved sequentially. Build your CMC strategy around the platform from the beginning, accumulate stability data across every batch you make regardless of which variant it is, and document the comparability analysis between variants carefully. That documentation becomes an asset when you want to add the fifteenth variant to your BLA.

The NGS Safety Guidance: What It Requires

Published April 14, the NGS safety guidance is the operational companion to the PMF framework. Where the PMF guidance tells you what evidence you need, the NGS guidance tells you how to generate the genomic safety data that underpins that evidence for GE products specifically. It’s more technically detailed and less conceptually novel, but for anyone building in the GE space it’s essential reading.

The core question the NGS guidance is addressing is how you assess whether a genome editor is doing what you want it to do and nothing else. Every GE product has an intended on-target editing site. The safety concern is off-target editing: the editor acts on genomic sequences it wasn’t designed to target, either because those sequences have some homology to the intended target or because random factors result in activity elsewhere. Off-target edits can be benign, disruptive, or potentially oncogenic depending on where they occur and what they disrupt. Chromosomal translocations, which can occur when double-strand breaks happen at multiple locations and are repaired incorrectly, are a related concern.

FDA’s guidance establishes that NGS-based methods are the expected standard for characterizing this risk profile and specifies what those methods need to demonstrate. The guidance covers sequencing strategy, sample selection, off-target site nomination methods, confirmatory testing, analysis parameters, reporting requirements, and accounting for human genetic variation. The level of specificity is unusual for FDA guidance and that’s actually the point. One of the historical pain points for GE sponsors has been ambiguity about what the agency actually needs to see in an IND submission for off-target analysis. This guidance eliminates a lot of that ambiguity.

On sequencing strategy, the guidance distinguishes between short-read and long-read sequencing based on the nature of the edits being assessed. For edits affecting short stretches of DNA up to around 50 base pairs, short-read methods may be adequate. For larger insertions or deletions, long-read methods are required. The guidance is also clear that sequencing depth matters: you need to be sequencing at depth sufficient to detect off-target events occurring at frequencies lower than your on-target edit rate, because off-target events by definition occur less frequently if your product is working as intended. The guidance requires sponsors to provide data supporting the adequacy and sensitivity of their sequencing depth, either from internal validation experiments or peer-reviewed literature.

Off-Target Analysis: The New Baseline

The off-target analysis framework in the NGS guidance is the most practically important section for anyone doing diligence on a GE asset or building a company in this space. FDA lays out a two-stage process: off-target site nomination followed by confirmatory testing. Nomination is about identifying candidate off-target sites using computational and experimental methods. Confirmation is about actually measuring editing activity at those sites in appropriate cell types.

For nomination, FDA recommends using multiple approaches. The guidance distinguishes between modality-specific methods, biochemical assays and cell-based assays, and generally applicable methods including in silico computational algorithms and unbiased NGS-based methods. The choice of approach depends on the mechanism of action of the editor. Cell-based and biochemical assays were originally developed for editors that create double-strand breaks, like standard Cas9. Base editors and prime editors create nicks rather than breaks and may require modified or purpose-built assays. FDA is explicit that assays designed for double-strand break detection may not adequately capture off-target activity from nick-based editors and sponsors need to justify their assay selection with reference to the mechanism of their specific product.

The in silico nomination component requires scanning the reference human genome for sequences with homology to the guide RNA or target sequence, accounting for mismatches and bulges in both the DNA and gRNA, and considering PAM sequence requirements or other modality-specific recognition requirements. For CRISPR-Cas9, the canonical PAM is NGG but the guidance notes that spCas9 has been documented to recognize non-canonical PAM sequences and sponsors need to account for those in their search strategy. The guidance also introduces a whole section on off-target analysis accounting for human genetic variation, which is a relatively new wrinkle. Individual human genomes carry millions of nucleotide variants compared to the reference sequence, and some of those variants in a given patient could create new off-target sites that don’t exist in the reference genome. FDA recommends an in silico analysis using variant databases to identify potential variant-contributed off-target sites. For ultra-rare disease programs treating a single patient or patients from a specific genetic ancestry, the guidance suggests this analysis may not always be required with the original IND submission, but sponsors are encouraged to discuss this with FDA early.

On confirmatory testing, the guidance says all nominated off-target sites should ideally be confirmed, but FDA acknowledges sponsors may select a subset with scientific justification. The rationale for subsetting can include statistical cutoffs, editing rate cutoffs, or detection of sites across multiple samples. The guidance warns against overly stringent filtering criteria, meaning FDA wants to see a broad set of sites evaluated even if the final confirmed list is small. This is a practical tension for sponsors: the more conservative your nomination method, the larger the list of sites you need to confirm, which increases costs. The guidance implicitly encourages sponsors to work through this tradeoff explicitly and document their reasoning.

For chromosomal translocation analysis, the guidance requires that GE modalities known to create double-strand breaks have sensitive quantitative NGS-based assessment of chromosomal integrity in edited cells. If confirmed off-target sites are identified, FDA expects an additional analysis evaluating potential translocation events between on-target and off-target sites. The guidance recommends sequencing strategies that minimize bias and use sequencing depth adequate to detect low-frequency translocation events.

What This Means for Investors and Founders

The investment thesis angle here operates on a few different levels. The most direct play is in companies building GE platforms for rare disease indications that previously had no viable commercial pathway because of the small patient population problem. The PMF framework doesn’t make those programs easy, but it makes them viable in a way they weren’t before. Programs that were stuck in a pre-clinical holding pattern waiting for a clearer regulatory path now have one. That’s a catalyst.

For platform companies specifically, the modular product variant logic is a multiplier. If you can get a CRISPR platform approved for one mutation in a given gene and then extend to additional mutations via the plausible mechanism pathway without full re-approval, the per-variant commercial value calculation looks very different. Think about something like a company targeting multiple pathogenic variants in a single gene responsible for a severe pediatric neurological disease. There might be fifty variants across the patient population, each affecting a handful of kids globally. Under the old framework, that’s fifty impossible development programs. Under the new framework, it’s potentially one BLA with fifty variants. The clinical and regulatory work to get the first few variants approved is the hard part. After that, adding variants is primarily a CMC and NGS safety exercise. That’s a dramatically better unit economics model for the platform holder.

The natural history data piece is worth flagging as an investment theme in its own right. The PMF guidance leans heavily on well-characterized natural history as external control. For many ultra-rare diseases, that data doesn’t exist in usable form, or it exists in scattered case reports and small registries that aren’t structured for regulatory use. There’s a real opportunity for companies building natural history study infrastructure and real-world data assets in rare disease to become critical enablers of the PMF pathway. Patient registries, longitudinal outcome tracking, and disease-specific biomarker validation are all assets that become more valuable in a world where natural history data can serve as the control arm for a marketing approval.

The ASO angle also deserves attention. The PMF guidance covers both GE and RNA-based therapies including ASOs, and the ASO case is in some ways more commercially near-term. ASO chemistry for certain chemical classes is well-characterized, the delivery problem for some tissue types is largely solved, and the target identification problem is mostly a sequencing and bioinformatics exercise. For a disease caused by a gain-of-function mutation in a highly expressed gene where the therapeutic strategy is knockdown of the mutant transcript, the PMF framework is almost tailor-made. You have a clear molecular target, a well-understood therapeutic mechanism, and a product class with established safety pharmacology. The main things you need to demonstrate are target engagement, which is often measurable directly from a biomarker, and clinical benefit against natural history. That’s a much shorter development timeline than anything involving a novel small molecule or biologic in a traditional indication.

The Regulatory Arbitrage Angle

This is where it gets interesting for sophisticated investors. The PMF framework and the NGS safety guidance together create a window of regulatory clarity that is temporally valuable. FDA has now published explicit standards, but the competitive landscape for ultra-rare GE and ASO programs hasn’t yet adjusted to those standards. Most of the capital in rare disease right now is still chasing programs that look like traditional drug development, relatively larger patient populations, established endpoints, proven delivery mechanisms. The PMF pathway opens up a class of programs that weren’t viable three years ago and are now genuinely viable, but haven’t yet attracted the capital and attention they will attract once the first approvals come through this pathway and people see it actually work.

The information asymmetry here is real. Reading and understanding two hundred pages of FDA draft guidance is not something most generalist investors do. The people who understand the specific implications for sample selection in ex vivo versus in vivo products, or the manufacturing comparability leverage for GE variants, or the difference in off-target nomination methodology between Cas9 and base editing, are a small community. That community is essentially being handed a regulatory roadmap for a class of assets that the broader market is underpricing.

There’s also a timeline dynamic worth flagging. Both guidances are in draft form and open for public comment, 60 days for the PMF guidance and 90 days for the NGS guidance. The comment periods close later this year. Finalization typically takes another 6-18 months depending on how many substantive comments are received and how much revision is warranted. The practical effect is that sophisticated sponsors are already building programs around the framework regardless of the finalization status, because the draft guidance signals FDA’s current thinking clearly enough to design around it. But the full force of investor attention won’t land until the first approval comes through this pathway, which is probably 2027 or 2028 at the earliest given where most programs are today. That timing gap is the arbitrage window.

Risks and Open Questions

No framework this novel comes without real risks and unresolved questions, and it would be sloppy analysis to leave those out.

The evidentiary standard for the PMF pathway, while clearly articulated in principle, is going to be worked out in practice through the review of specific programs. The guidance is explicit that it doesn’t provide recommendations on specific development programs, endpoints, or approval pathways. Those get resolved through the pre-IND and IND meeting process with the relevant review division. That’s not a problem exactly, but it means there will be program-specific variation in how strictly FDA applies the natural history external control standard and what constitutes adequate confirmation of target engagement. Early programs through this pathway will establish the precedents that define what’s actually required, and those first movers bear more regulatory risk than programs that follow once the playbook is clearer.

The off-target analysis requirements in the NGS guidance are technically demanding and potentially expensive for very early-stage programs. The requirement for biological replicates, the preference for patient-derived cells or cells engineered to harbor the target mutation, the need for confirmatory testing at nominated sites, and the accounting for human genetic variation all add meaningful cost and complexity to the pre-IND package. For a true single-patient program, FDA acknowledges that some of the population genetics analysis may not be necessary, but the core off-target nomination and confirmation work still needs to happen. The guidance encourages early FDA engagement through INTERACT and pre-IND meetings specifically to help sponsors scope these requirements appropriately for their specific product, and that’s genuinely useful advice.

The commercial pathway question also remains open. FDA approving an individualized therapy for a single patient is a remarkable scientific and regulatory achievement, but it doesn’t automatically create a business. Reimbursement for ultra-personalized therapies is genuinely unsolved. Payers have no established framework for valuing a drug with a patient population of one. The manufacturing economics for truly patient-specific products are punishing. The PMF framework is designed to create regulatory viability, not commercial viability, and those are different problems. The more interesting commercial model is probably the modular platform approach described above, where the individualized therapy pathway is used to establish proof of concept for a platform that can ultimately serve larger addressable populations through variant extension.

Finally, it’s worth noting that these are draft guidances, not final rules. The comment period process can result in meaningful changes. Industry will almost certainly push back on specific aspects of the NGS guidance, particularly around the breadth of off-target site confirmation requirements and the population genetics analysis. Academic stakeholders and patient advocacy groups will weigh in on the clinical standards in the PMF guidance. How FDA responds to those comments will matter for exactly how burdensome these pathways are in practice. The directional signal is clear and unlikely to reverse, but the specific parameters will evolve.

None of that changes the fundamental conclusion, which is that this regulatory shift is real, it’s significant, and it’s creating opportunities that a lot of the market hasn’t priced yet. The rare disease genomics space just got a lot more interesting.​​​​​​​​​​​​​​​​

What it is: The ACCESS (Advancing Chronic Care with Effective, Scalable Solutions) Model is a 10-year, voluntary, nationwide CMS Innovation Center model launching July 5, 2026, testing an Outcome-Aligned Payment (OAP) methodology for technology-enabled chronic care across four clinical tracks: eCKM (early cardiometabolic), CKM (full cardiometabolic/diabetes/CKD), MSK (musculoskeletal pain), and BH (behavioral health: depression and anxiety).

Key payment mechanics: Monthly fixed per-patient payments with a 50% withhold reconciled at end of 12-month care periods. Full payment contingent on achieving OAP Measure targets across a patient panel. The Outcome Attainment Threshold (OAT) starts at 50% in the first 18 months. A Substitute Spend Adjustment (SST starting at 90%) penalizes participants whose patients receive duplicative FFS services for the same condition from other providers. Only the larger of the two adjustments is applied per reconciliation period, capped at 50% and 25% respectively.

The payer context: 14 major payers representing 165 million covered lives have signed the ACCESS Payer Pledge, committing to align commercial, MA, and Medicaid payment to the model’s structure by January 1, 2028. This includes UnitedHealthcare, Humana, Cigna, CVS/Aetna, Centene, Devoted Health, and several BCBS plans.

The participant field: 150-plus organizations accepted as of April 2026, spanning virtual-first digital health companies, traditional brick-and-mortar specialists, pharmacies, care management vendors, and a handful of entries that defy easy categorization.

Key questions addressed: Who has the business model alignment, patient panel sophistication, and outcome track record to actually make money here? Who will make the biggest clinical dent in Medicare’s chronic disease burden? Who is absent from the list who probably should be there? And who are we looking at going, really?

How to Think About This List Before Getting Into Specifics

There’s a temptation to treat the ACCESS accepted applicant list as a flat roster, an alphabetical spreadsheet of companies that all said yes to the same thing. That would be a mistake. The gap between the top tier and the bottom tier of this group, in terms of actual readiness to thrive in an outcome-aligned payment model, is enormous. The business model differences are even starker than the clinical ones. Some of these organizations have been building toward exactly this moment for years, running commercial book-of-business programs with outcome accountability, investing in remote monitoring infrastructure, and proving out that they can move biomarkers at scale. Others are walking in from adjacent markets with a lot of enthusiasm and not a lot of evidence. A few are genuinely puzzling additions.

To understand who’s positioned well, you need to internalize one thing about how the OAP payment structure actually works in practice. The model pays a fixed monthly per-patient rate (amounts not yet published as of the April 2026 application period), with 100% of payments flowing in months one through six and the back half effectively held until the 12-month mark. Full release of that withhold depends on the participant’s Outcome Attainment Rate, meaning the share of their total patient panel who hit the required clinical targets. The OAT starts at 50% across the first 18 months, which sounds lenient until you realize most of these organizations have never tried to move Medicare FFS patients through an outcome-linked accountability framework before. Medicare populations are older, more complex, and more likely to have comorbidities that complicate biomarker improvement. The organizations that have spent years managing commercially insured populations in their 40s and 50s are going to face a real wake-up call when the panel shifts to original Medicare beneficiaries, many of whom are in their late 60s, 70s, and 80s with entrenched disease patterns and polypharmacy issues.

The Substitute Spend Adjustment is the other thing that makes this genuinely hard. If a participant’s patients start getting physical therapy evaluations, psychiatric evals, DSMT sessions, or cardiac monitoring billed through FFS channels by other providers during the care period, the participant’s Substitute Spend Rate drops and their payment gets dinged. This creates a coordination burden that tech-first, virtual-only companies are particularly bad at managing, because they often don’t have deep enough relationships with a patient’s brick-and-mortar care team to prevent those FFS encounters from happening. That 90% SST in year one is going to be a real problem for anyone who doesn’t have tight care coordination workflows.

With that backdrop, let’s go through the landscape.

The Category That Will Probably Make the Most Money: Scaled Virtual-First CKM and eCKM Specialists

Read more

1. Abstract

2. The Great Prior Auth and Denials Paradox

3. Fraud by the Numbers: Government Programs vs. Commercial Plans

4. How Prior Auth and Denials Actually Work as Fraud Prevention

5. The Medicare and Medicaid Fraud Landscape: A Quick Tour of the Wreckage

6. Why Private Payers Don’t Have This Problem (Or At Least Not Nearly as Bad)

7. The Uncomfortable Tradeoff Nobody Wants to Talk About

8. Where the Opportunities Are

9. The Bottom Line

Abstract

- Prior authorization and claims denials are universally despised across the healthcare ecosystem, with bipartisan legislative efforts aimed at curtailing their use in commercial insurance.

- Meanwhile, Medicare and Medicaid lose an estimated $100-300B+ annually to improper payments and outright fraud, numbers that dwarf fraud losses in commercial plans.

- Commercial payers deploy prior auth, claims denials, utilization management, and sophisticated analytics that function as a de facto fraud and abuse prevention layer, one that government programs largely lack.

- The thesis here: the very mechanisms providers and patients hate most in commercial insurance may be the primary reason private plans don’t hemorrhage money to fraud at anything close to the rate of public programs.

- Prior auth blocks fraud prospectively by forcing review before payment. Denials block fraud retrospectively by catching suspicious claims after submission but before or shortly after payment. Together they create a two-layer defense that government programs have historically lacked.

- For health tech entrepreneurs and operators, this creates a massive opportunity space around fraud prevention, payment integrity, and automation tools targeting government programs, while also raising hard questions about the real cost of dismantling prior auth and denial controls in commercial plans.

- Key opportunity themes include AI-driven prior auth automation, intelligent denial management, predictive fraud analytics for government payers, payment integrity platforms, and provider workflow tools that balance access with accountability.

The Great Prior Auth and Denials Paradox

There is a strange disconnect happening in healthcare policy right now, and it is worth pausing on because it has real implications for anyone building, operating, or investing in health tech. On one side of the conversation, you have providers, patients, advocacy groups, and frankly most of Congress united in their desire to gut prior authorization requirements and rein in claims denials in commercial insurance. The complaints are legitimate and well-documented. Prior auth delays care. Denials force appeals processes that consume enormous provider resources and sometimes result in patients simply going without needed treatment. Together, these mechanisms create administrative burden that costs the system billions, burns out physicians, and occasionally kills people. The horror stories are real, and nobody is arguing otherwise.

But on the other side of the ledger, something far less discussed is happening. Government insurance programs, specifically Medicare and Medicaid, are bleeding money at a rate that should make anyone with a finance background physically uncomfortable. We are talking about improper payment rates that, depending on whose numbers you trust, run somewhere between $100 billion and $300 billion per year. Some estimates go higher. A meaningful chunk of that is straight-up fraud. Not billing errors. Not coding mistakes. Fraud. Fake patients, phantom clinics, organized crime rings, the whole nine yards.

And here is the part that nobody seems to want to connect: Medicare and Medicaid have historically operated with far less rigorous prior authorization and far lower denial rates than commercial plans. When government programs do deny claims, it is often retrospective, meaning the money already moved and recovering it becomes a lengthy, expensive process that frequently fails. The correlation between “fewer prospective controls and less aggressive denial practices” and “dramatically more fraud” is not subtle. It is staring everyone in the face. Yet the policy conversation treats these as two completely separate issues, as if the people screaming about prior auth and denials in commercial insurance and the people screaming about fraud in government programs are living on different planets.

They are not. They are describing two sides of the same coin.

Fraud by the Numbers: Government Programs vs. Commercial Plans

Let’s get into the actual numbers because this is where the argument gets hard to ignore. CMS publishes improper payment rates annually, and while the methodology has shifted over the years, the directional story is consistent and grim. Medicare fee-for-service has run improper payment rates in the 6-8% range in recent years, which on a base of roughly $450 billion in annual FFS spending translates to somewhere around $30-40 billion per year just in traditional Medicare FFS. Medicare Advantage adds another layer of complexity with risk adjustment coding issues that GAO and OIG have estimated cost taxpayers tens of billions more annually. HHS OIG has put the MA overpayment figure in the range of $12-25 billion depending on the year and methodology.

Medicaid is arguably worse on a percentage basis. The most recent CMS data pegged the Medicaid improper payment rate above 20% in some years, though that number bounced around due to measurement changes. On a program that spends over $700 billion annually including both federal and state share, even a conservative 10% improper payment rate means $70 billion walking out the door incorrectly. And that 20%+ figure, when it showed up, implied something north of $140 billion.

Now compare that to commercial insurance. The National Health Care Anti-Fraud Association has historically estimated that fraud accounts for roughly 3-10% of total health spending, but that is an aggregate number across all payers. When you isolate commercial plans specifically, the fraud and improper payment rates tend to run dramatically lower than government programs. The big commercial payers, your UnitedHealthcare, Anthem, Aetna, Cigna, Humana on the commercial side, typically report fraud loss ratios well under 3%, and most internal estimates from payer executives suggest the real number is closer to 1-2% for well-managed commercial books of business.

So you have got government programs losing somewhere in the range of 8-20% to improper payments and fraud, and commercial plans losing maybe 1-3%. That is not a rounding error. That is an order of magnitude difference. And the single biggest structural distinction between these two payer types, besides the obvious scale and population differences, is the intensity of prospective utilization management and the willingness to deny claims that do not meet clinical or billing criteria. Which is a fancy way of saying prior auth and the associated denial machinery.

How Prior Auth and Denials Actually Work as Fraud Prevention

Most of the public conversation about prior auth and denials focuses on their role in clinical gatekeeping. Does the patient really need that MRI? Is that brand-name drug medically necessary when a generic exists? Should this surgery happen at an outpatient center instead of an inpatient facility? These are the utilization management questions that drive providers crazy, and rightfully so in many cases where the clinical answer is obvious and the auth process just adds friction and delay. Similarly, the denials conversation tends to focus on legitimate claims getting rejected for technicalities or documentation gaps, forcing providers into costly appeal cycles.

But there is a second function of both prior auth and denials that gets almost zero airtime: fraud prevention. These two mechanisms work as complementary layers of defense. Prior auth works as a prospective fraud deterrent because it forces review of the service before it happens. Denials work as a concurrent and retrospective fraud barrier because they catch suspicious claims that make it past the front door, rejecting payment before or shortly after the money moves. Together, they create a two-layer system that is fundamentally different from the pay-and-chase model that Medicare has historically relied on, where claims get paid first and audited later, sometimes much later, sometimes never.

Think about it from the perspective of someone running a fraudulent billing operation. If you are billing a commercial plan for, say, a series of expensive genetic tests on patients who never actually received them, you have a problem at two levels. First, the plan is likely going to require prior authorization for those tests. Someone is going to review the clinical documentation before approving the service. The patient’s primary care physician may get a notification. The plan may require the test to be performed at a credentialed lab. Second, even if you somehow get past prior auth, the claims adjudication system is going to run those claims through editing logic, medical policy rules, and increasingly sophisticated analytics before payment. Claims that trigger flags get denied, and the denial creates a paper trail that feeds into the plan’s special investigations unit. There are multiple checkpoints that a fraudulent claim has to clear before money changes hands, and each checkpoint generates data that makes the next fraudulent claim harder to push through.

Now try the same scheme against Medicare FFS. Submit the claim. Get paid in 14-30 days. Maybe get audited in two years. Maybe not. If a claim does get denied in Medicare, it is usually for a coding or documentation technicality, not because someone prospectively reviewed the clinical scenario. The structural vulnerability is enormous, and organized fraud rings know it. The DOJ has prosecuted cases involving hundreds of millions of dollars in Medicare fraud perpetrated by operations that ran for years before anyone caught on. Some of the most notorious cases, like the $1.3 billion home health fraud takedown in 2022 or the $1.4 billion telemedicine fraud schemes that DOJ rolled up during and after COVID, specifically exploited the absence of prospective controls and the low denial rates in Medicare.

Commercial prior auth and denials are not perfect. They are often clunky, slow, and applied in situations where they add cost without clinical value. But as structural anti-fraud mechanisms, they work remarkably well. Prior auth as the front gate and denials as the back gate create a system where it is genuinely difficult for fraudsters to operate at scale.

The Medicare and Medicaid Fraud Landscape: A Quick Tour of the Wreckage

For anyone not tracking the government program fraud space closely, a brief tour of recent enforcement actions is instructive. DOJ’s Health Care Fraud Strike Force, which operates in major metro areas across the country, has been running coordinated takedowns for over fifteen years. The annual totals are staggering. In June 2023, DOJ announced charges against 78 defendants across the country for approximately $2.5 billion in alleged fraud. The 2022 action tagged $1.7 billion. These are annual events now, recurring like clockwork, and the amounts keep growing.

The schemes are diverse and increasingly sophisticated. Durable medical equipment fraud remains a perennial favorite, with operations billing for wheelchairs, braces, and orthotics that patients never received. Home health fraud is massive, particularly in states like Texas and Florida, where fake home health agencies have been caught billing for services on patients who were either dead, not homebound, or never visited. Compounding pharmacy fraud exploded a few years back, with pharmacies billing government programs for expensive custom compounds that were either never dispensed or therapeutically unnecessary.

And then there is the telemedicine fraud wave that came out of COVID. When CMS loosened telehealth restrictions during the public health emergency, including dropping prior auth requirements, expanding the types of services eligible for telehealth billing, and effectively lowering the bar for claim denials, fraud operators moved in almost immediately. The DOJ has since prosecuted telemedicine fraud cases totaling multiple billions, with schemes typically involving call centers that would cold-call Medicare beneficiaries, conduct sham telehealth visits, and then bill for expensive genetic tests, durable medical equipment, or pain creams. The beneficiaries often had no idea their Medicare numbers were being used.

The common thread in almost all of these schemes is the absence of prospective review and the low rate of claim denial. The fraudsters specifically target Medicare and Medicaid because these programs pay first and investigate later, and because the odds of any given fraudulent claim being denied before payment are relatively low compared to commercial plans. The pay-and-chase model combined with low denial rates is not just inefficient. It is an invitation.

Medicaid fraud has its own special flavor, often involving providers in long-term care, behavioral health, personal care services, and substance abuse treatment. The behavioral health and substance abuse categories have been particularly problematic, with “Florida shuffle” style operations cycling patients through sham treatment programs and billing Medicaid for services that were either not rendered or grossly substandard. California’s Medicaid program alone has estimated fraud losses in the billions annually.

Compare any of this to what happens in commercial insurance and the contrast is sharp. Commercial fraud certainly exists, but it tends to be smaller in scale, detected faster, and harder to sustain because the prospective controls and more aggressive denial practices catch anomalies before large sums move.

Why Private Payers Don’t Have This Problem (Or At Least Not Nearly as Bad)

The question worth asking is: what exactly are commercial plans doing differently? The answer is not one thing but a layered system of controls, and prior auth and denials sit near the top of that stack.

First, commercial plans maintain provider credentialing processes that are more rigorous than Medicare’s enrollment system. To bill a commercial plan, a provider typically needs to be credentialed through a process that verifies licensure, malpractice history, practice location, and specialty qualifications. Medicare has its own enrollment process, obviously, but it has historically been more permissive and slower to remove bad actors. CMS has made improvements here, particularly through the Affordable Care Act’s enhanced screening provisions, but the commercial credentialing process remains tighter in practice.

Second, commercial plans use prior authorization as a prospective control on high-cost services. This means that before expensive imaging, surgeries, specialty drugs, genetic tests, and durable medical equipment are authorized, someone at the plan or its utilization management vendor reviews the request. This review serves a dual purpose. It assesses medical necessity, which is the clinical gatekeeping function everyone complains about, and it validates that the requesting provider, the patient, and the proposed service all check out. It is very hard to bill a commercial plan for a service on a patient who does not exist or from a facility that is not real when someone is reviewing the request prospectively.

Third, commercial plans deploy denial logic as a second line of defense. Claims that make it past prior auth still run through automated editing systems, medical policy engines, and payment integrity algorithms at the point of adjudication. Claims that do not match the authorization, that come from non-credentialed providers, that contain coding anomalies, or that trigger fraud indicators get denied. These denials serve a different function than the prior auth layer. Where prior auth prevents fraud from entering the system, denials catch it at the point of payment and stop the money from moving. The combination of prospective and concurrent controls is what makes the commercial system so much harder for fraudsters to exploit than government programs, which tend to rely more heavily on post-payment audits.

Fourth, commercial plans invest heavily in analytics and special investigation units. The big payers run sophisticated data science operations that flag billing anomalies, provider outliers, and suspicious patterns in near-real time. When these analytics generate flags, the response is often a targeted increase in prior auth requirements for the flagged provider or an increase in the denial rate for specific claim types, creating a feedback loop that tightens controls around suspicious actors. Medicare has its own analytics capabilities through CMS’s Center for Program Integrity and contractors, but the commercial payer analytics infrastructure is generally more advanced and more aggressively deployed.

Fifth, commercial plans have a direct financial incentive to prevent fraud and deny improper claims. Every dollar lost to fraud comes directly off the bottom line. Medical loss ratio regulations under the ACA mean that plans need to keep admin costs within bounds, but fraud losses hit the medical cost side of the equation and directly impact profitability. This creates a strong alignment between the payer’s economic interest and aggressive use of prior auth and denials. Medicare and Medicaid, by contrast, are spending taxpayer money, and while CMS certainly has fraud prevention programs, the institutional urgency is different. Bureaucratic processes, interagency coordination challenges, and political dynamics all slow the government’s response relative to what a commercial plan with direct profit exposure can do.

Sixth, commercial plans benefit from smaller, more defined networks. A commercial plan knows its providers. It has contracts with them. It knows their billing patterns, their patient panels, their historical utilization. When something looks off, the signal is easier to spot against a known baseline, and the plan can respond by increasing prior auth requirements or denial rates for that specific provider. Medicare, which is essentially an open network where any enrolled provider can bill the program, has a much harder signal-to-noise problem. The sheer scale and openness of the Medicare provider base makes it structurally more vulnerable to bad actors blending in.

The Uncomfortable Tradeoff Nobody Wants to Talk About

Here is where this gets politically uncomfortable, which is probably why the conversation rarely happens in mixed company. The prior auth and denials machinery that everyone hates in commercial insurance is performing a fraud prevention function that is saving enormous amounts of money. The government programs that lack equivalent controls are hemorrhaging cash to fraudsters at a rate that, if it were happening in any other sector, would be considered a national scandal.

This does not mean that prior auth and denials as currently implemented are optimal. They are not. Prior auth is too slow, too manual, too often applied to routine services that do not need prospective review. Denials are too often applied to legitimate claims for technical reasons, creating enormous appeal volumes and delaying payment to honest providers. The Gold Card programs that some states have implemented, where high-performing providers get exempted from prior auth requirements, are a smart step in the right direction. So are the CMS interoperability rules requiring electronic prior auth by 2027, and the various health tech solutions automating both the prior auth and denial management workflows.

But the conversation about reforming these mechanisms needs to happen with clear eyes about what happens when you remove prospective controls and reduce denial rates entirely. The Medicare and Medicaid experience provides a natural experiment, and the results are not encouraging. When you pay first and chase later, you lose a lot of money. When you do not require prospective justification for services, fraud scales easily. When your denial rates are low and your provider enrollment and credentialing processes are permissive, bad actors get in and stay in.

The advocacy community, and frankly a lot of the health policy commentariat, talks about prior auth and denial reform as if the only variable is access to care. And access matters enormously, nobody is disputing that. But the fraud prevention function matters too, and pretending it does not exist leads to policy proposals that could have very expensive unintended consequences.

Consider what would happen if commercial plans were required to eliminate prior auth and dramatically reduce denial rates, as some legislative proposals have suggested. Based on the differential fraud rates between commercial and government programs, you would expect a meaningful increase in fraudulent billing. How much? Hard to say precisely, but even a 2-3 percentage point increase in the commercial fraud rate would represent tens of billions of dollars annually, costs that would ultimately flow through to employers and consumers in the form of higher premiums. The actuaries at the big plans have modeled these scenarios, and the numbers are not pretty.

Where the Opportunities Are

For anyone building or operating in health tech, this tension between prior auth and denial reform on one hand and fraud prevention on the other creates several massive opportunity areas.

The most obvious is prior auth automation. The market for solutions that make prior auth faster, less burdensome, and more clinically intelligent is large and growing. Platforms that can automate the prior auth submission process, use clinical data to pre-populate authorization requests, and reduce turnaround times from days to minutes are addressing a real pain point without eliminating the prospective review function. The value proposition is straightforward: keep the fraud prevention benefit of prior auth while removing the administrative friction that delays care and burns out clinicians.

Denial management and optimization is equally compelling, and it cuts both ways. On the provider side, tools that help practices and health systems manage denials more efficiently, automate appeals, and reduce denial rates for legitimate claims have a massive addressable market. On the payer side, solutions helping plans deploy smarter denial logic that catches fraud and coding errors without generating the massive false positive rates that plague current systems are equally valuable. The ideal outcome is a denial system that is more accurate in both directions: fewer denials of legitimate claims and more denials of fraudulent ones.

Government program fraud prevention is arguably the biggest greenfield opportunity in the bunch. Given the scale of improper payments in Medicare and Medicaid, there is an enormous market for solutions that bring commercial-grade prior auth, denial logic, and fraud analytics to government programs. CMS has been investing in this area, and the Fraud Prevention System that CMS operates has identified and prevented billions in improper payments. But the gap between government and commercial capabilities remains wide. Predictive models, provider risk scoring platforms, and real-time claims surveillance tools specifically built for the Medicare and Medicaid context address a gap that costs taxpayers hundreds of billions annually.

Payment integrity platforms represent a related but distinct opportunity. Payment integrity goes beyond fraud to include coding accuracy, clinical validation, and billing compliance. The payment integrity market for commercial payers is already well-established with large incumbents. But the government program payment integrity space is less mature and arguably more impactful given the higher improper payment rates.

Provider-side workflow tools that help legitimate providers navigate the prior auth and denials landscape while ensuring compliance represent another substantial market. Think of this as the provider workflow layer that sits between the clinical decision and the payer authorization or claim adjudication. Tools that can predict whether a prior auth will be required, pre-check the likely approval criteria, assemble the necessary documentation automatically, submit electronically, and proactively address the most common denial triggers before submission are valuable to providers and do not threaten the fraud prevention function that payers rely on.

And then there is intelligent utilization management, which is more speculative but potentially very large. This means moving beyond binary approve/deny logic to more nuanced, risk-stratified approaches. A system that applies intensive prospective review and higher denial thresholds to high-risk providers, new-to-network entities, and unusual service patterns, while fast-tracking authorizations and reducing denial friction for established providers with clean billing histories. This is essentially what Gold Card programs do at a coarse level, but there is room for much more granular, data-driven approaches that could dramatically reduce administrative burden for the vast majority of legitimate providers while actually increasing scrutiny on the small percentage of actors who account for most of the fraud.

The Bottom Line

The prior auth and denials debate in healthcare is one of those situations where the loudest voices in the room are not necessarily wrong, but they are definitely incomplete. Yes, prior auth as currently implemented is often terrible. Yes, denials of legitimate claims waste enormous resources and delay necessary care. Yes, both need to be reformed, automated, and made more intelligent.

But the argument that prior auth should simply be eliminated and denial rates slashed across the board, that these mechanisms serve no useful purpose, that they are purely tools for payers to deny care and boost profits, that argument does not survive contact with the data. The differential fraud rates between commercial plans (which use prior auth and denials aggressively) and government programs (which historically have not) tell a clear story. These mechanisms, for all their flaws, are functioning as critical fraud prevention layers. And the scale of fraud in programs that lack them is genuinely breathtaking.

For health tech entrepreneurs and operators, this creates a rare situation where both sides of the equation present opportunity. The reform side needs better technology to make prior auth less painful and denials more accurate. The fraud prevention side needs better technology to bring government programs up to something approaching commercial-grade integrity. And the sweet spot is solutions that can do both simultaneously, reducing the burden on legitimate providers while increasing the detection of fraudulent actors.

The regulatory trajectory supports this view. CMS is moving toward electronic prior auth requirements. Multiple states are passing Gold Card laws. Congress continues to advance bipartisan prior auth and denial reform legislation. And at the same time, CMS is investing in enhanced program integrity tools and the DOJ continues to ramp up healthcare fraud enforcement. These parallel tracks are not contradictory. They are complementary. The future of utilization management is not “fewer controls.” It is “smarter controls.” And that is a technology problem, which means it is exactly the kind of problem that health tech companies can solve.

The fraud numbers in government programs are not going down on their own. The political pressure to reform prior auth and denials in commercial plans is not going away. Both problems need technology solutions. Both represent enormous markets. And both are underfunded relative to their scale.​​​​​​​​​​​​​​​​

1. Abstract

2. Something Weird Happened Last Week

3. What Mythos Actually Did

4. Healthcare Was Already Getting Wrecked

5. The Medical Device Problem Nobody Wants to Talk About

6. Why Health Tech Investors Should Be Paying Very Close Attention

7. The Startup Opportunities Are Bizarre and Real

8. The Alignment Stuff Matters More Than You Think

9. What This Means for Portfolio Companies Right Now

10. The Uncomfortable Timeline

Abstract

- On April 7, 2026, Anthropic announced Claude Mythos Preview alongside Project Glasswing, a defensive cybersecurity coalition of 40+ organizations including AWS, Apple, Google, Microsoft, NVIDIA, and CrowdStrike

- Mythos Preview autonomously discovered thousands of zero-day vulnerabilities across every major operating system and web browser, including bugs that survived 27 years of expert human review

- Anthropic declined to release the model publicly due to its cybersecurity capabilities, a first in commercial AI

- Healthcare was the most targeted sector for ransomware in 2025, accounting for 22% of all disclosed attacks with a 49% year-over-year increase

- No major healthcare organization is currently a Project Glasswing partner

- The 244-page system card revealed the model exhibited concealment behaviors, evaluation awareness in 29% of test transcripts, and sandbox escape capabilities

- Average healthcare breach costs reached $7.42 million in 2025, nearly double the cross-industry average

- Proposed HIPAA Security Rule updates expected to finalize May 2026 will mandate encryption, MFA, and network segmentation

- Implications span cybersecurity, medical device security, health data infrastructure, EHR systems, and early-stage investment thesis construction

Something Weird Happened Last Week

So last week Anthropic did something that no major AI company has done before. They built their most powerful model and then decided not to sell it. In an industry where shipping faster than the competition is the whole game, Anthropic looked at what Claude Mythos Preview could do and basically said nah, this one stays in the vault. The model is too good at hacking things.

That sentence probably sounds like marketing. It is not. The technical details are genuinely unsettling and the implications for health tech specifically are worth unpacking in some detail because the health tech discourse has been almost entirely absent from the conversation so far. The founding partners of Project Glasswing, the coalition Anthropic built around controlled access to Mythos, include AWS, Apple, Microsoft, Google, NVIDIA, CrowdStrike, Palo Alto Networks, Cisco, Broadcom, JPMorganChase, and the Linux Foundation. Notice who is missing from that list. No health system. No EHR vendor. No health data company. No payer. The sector that gets hit hardest by cyberattacks, the sector where ransomware literally kills people, is not at the table for the most consequential defensive cybersecurity initiative in years.

That gap alone should be alarming. But the deeper story here is about what the existence of Mythos class models means for health tech infrastructure, for medical device security, for the entire attack surface that the digital health ecosystem has been happily building on top of for the past decade. And for investors and builders in this space, the implications are both scary and, honestly, kind of exciting in terms of where capital should flow next.

What Mythos Actually Did

Read more