Building a Medicaid Community Engagement Verification Engine in Claude Code & Selling It to State Agencies Before the January 2027 Deadline: A Field Guide to the Land Grab Behind CMS-2454
🎧 Part I Podcast free on Spotify.
🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Abstract
On June 1, 2026 CMS dropped CMS-2454-IFC, the interim final rule that turns the Working Families Tax Cut law (Public Law 119-21) into an operational mandate. The headline: most non-pregnant adults ages 19 to 64 in the Medicaid adult group must log 80 hours a month of work, school, or community service, or clear an income test of roughly $580 a month, as a condition of eligibility. Deadline to implement is January 1, 2027. Affected: 43 states plus DC. Federal sweeteners on the table: $200M in Government Efficiency Grants and more than $600M in committed private-vendor support, on top of the standing 90/10 design match and 75/25 operations match for Medicaid eligibility systems. The cautionary tale: Georgia spent about $92M on its Pathways experiment, more than half of it on administration and technology, to cover a few thousand people. This essay walks through what the software has to do, how to actually build it in Claude Code without pretending a weekend hackathon equals a certified state system, how the federal match rewrites the unit economics, and how a small builder gets past Deloitte, Gainwell, and Conduent without getting flattened.
Table of Contents
Section one. What just changed and why every state Medicaid director is suddenly sweating
Section two. What the software actually has to do in plain terms
Section three. The Georgia cautionary tale, or how to spend ninety million dollars to cover a high school
Section four. Building it in Claude Code, the architecture and the unglamorous middle
Section five. The money, who pays and how the 90/10 match rewrites the deal
Section six. Getting in the door, procurement and the awkward dance with the incumbents
Section seven. The risks that can sink the whole thing
Section eight. The honest read on where the money actually is
Section one. What just changed and why every state Medicaid director is suddenly sweating
The short version is that a reporting requirement most states avoided for a decade just became federal law with a hard date attached. The rule CMS issued on June 1, 2026, formally the Medicaid Community Engagement Requirement, says that applicable individuals have to demonstrate 80 hours a month of qualifying activity, meaning a job, a work program, community service, half-time-or-more school enrollment, or some combination, or alternatively earn at least 80 times the federal minimum wage in a month, which works out to about $580 in 2026. States generally have to flip this on no later than January 1, 2027. Nebraska already went early, and a handful of others are weighing whether to beat the deadline for political reasons. CMS frames the whole thing as promoting self-sufficiency, and the accompanying ASPE study claims it could pull as many as 2.9 million people out of poverty under favorable employment conditions. Critics read the same machinery and see a coverage-loss engine dressed up as a jobs program. Both can be true at once, which is exactly why the operational layer matters so much.
Here is the part that should make any operator pay attention. The statute does not actually require people to work in any way that moves the labor market. Most adults on expansion Medicaid are already working or already qualify for an exemption. What the law requires is that the state prove it, every applicant at application, every enrollee at renewal, and optionally more often than that. That is a documentation and data-matching problem, not a workforce problem. When a state cannot verify compliance on its own, it has to mail a notice of noncompliance and give the person 30 calendar days to either document their hours or show they are exempt, after which the application can be denied or the enrollee disenrolled. Forty-three states plus the District of Columbia run an adult group and therefore have to build this. None of them have eighteen months of slack in their eligibility systems. That gap between a legal mandate and an unbuilt capability is the entire business.
Section two. What the software actually has to do in plain terms
Strip away the branding and the product is a verification and exemption-determination layer that bolts onto a state’s existing eligibility and enrollment system. The first job is sorting the population. Out of everyone in the adult group, the engine has to identify who is even subject to the rule and who is carved out, and the carve-outs are not trivial. The exempt list includes pregnant and postpartum individuals, the medically frail, people with a disability rating, parents and caretakers of a child 13 or younger or of a disabled dependent, American Indians and Alaska Natives, former foster youth, people in a drug or alcohol treatment program, inmates of public institutions, and anyone already satisfying SNAP or TANF work rules. Then there is a second tier of optional short-term hardship exceptions a state can elect to offer, covering things like inpatient stays, residence in a county with unemployment at or above 8 percent or 1.5 times the national rate, presidentially declared disaster areas, and travel for serious medical care. A meaningful share of the work is simply never bothering a person who should have been auto-exempted in the first place. Every unnecessary notice is a coverage loss waiting to happen and a call-center ticket that costs the state money.
The second job is proving the 80 hours for everyone left over, and the cheapest path is ex parte, meaning the state confirms compliance from data it can already reach before it ever asks the human for a pay stub. Wage data from the state department of labor, quarterly wage files, new-hire reporting, SNAP and TANF participation, SSA disability status, managed-care encounter data that flags a recent inpatient stay, even county-level unemployment feeds for the hardship logic. The engine ingests those, runs the match, and only kicks out a request to the individual when the data genuinely cannot answer the question. When it does have to ask, it needs a clean upload path, a way to accept an attestation where the rule allows one, a correctly timed 30-day clock, templated notices that survive a due-process challenge, and an appeals trail. Underneath all of it sits the reporting obligation back to CMS, since states that fail to submit the required monitoring data can land in corrective action. So the real spec is boring and enormous: identity resolution, rules evaluation, document handling, notice generation, deadline tracking, and audit-grade reporting, all of it correct enough to hold up when a legal aid attorney comes looking.
Section three. The Georgia cautionary tale, or how to spend ninety million dollars to cover a high school
Anyone pitching this should be able to recite Georgia from memory, because Georgia is the only state that has actually run a work requirement at scale and the numbers are a horror show that doubles as a sales deck. Pathways to Coverage launched in July 2023. By the GAO’s accounting, from 2021 through the first half of 2025 the program spent $54.2 million on administrative costs against $26.1 million on actual medical assistance, so more than two dollars went to running the machine for every dollar that touched a patient. Total program spend has been pegged north of $86.9 million, and once the consulting and legal extras get added the figure lands close to $92 million, which pencils out to something like $13,000 per enrollee. That GAO figure does not even include the roughly $27 million Deloitte earned to market the thing or another $10 million or so in additional consulting and litigation costs. About 88 percent of the administrative spend came from federal dollars, which is its own tell about who actually pays for this stuff.
Now the punchline. A year after launch, Pathways had enrolled around 4,300 people, against an estimated 246,365 potentially eligible. The state built a Ferrari-priced compliance apparatus to cover the population of a midsize high school. The lesson for a builder is not that the market is bad, it is that the incumbent approach is catastrophically inefficient, and the inefficiency is the opening. Most of that money went into reworking eligibility determination, duplicative technology, training, and a long court fight, not into anything resembling elegant automation. If a system can lift the ex parte match rate so that the overwhelming majority of compliant and exempt people never get a notice at all, the per-enrollee administrative cost falls through the floor and the coverage-loss optics improve at the same time. That combination, lower cost and fewer wrongful disenrollments, is the only pitch that survives contact with both a Republican governor’s budget office and a Democratic attorney general’s litigation threat. Georgia is the proof that the obvious way is the expensive way.
Section four. Building it in Claude Code, the architecture and the unglamorous middle
Here is where the fantasy meets the procurement officer. Claude Code is genuinely good at the parts that usually eat a vendor’s first six months, and it is useless at the parts that actually decide whether a state buys. Be honest about which is which. The rules engine is the sweet spot. The exemption logic, the activity-hours calculation, the income test, the hardship-county lookups, the 30-day clock, all of that is a large, fiddly, well-specified decision tree pulled straight from the rule text, and that is exactly the kind of work where an agentic coding setup earns its keep. A sane build keeps the policy logic in a declarative rules layer rather than hardcoded conditionals, so that when CMS issues the inevitable sub-regulatory clarification, or a given state elects a different bundle of optional hardship exceptions, the change is a config edit and a fresh test run instead of a code rewrite. Treat each state as a configuration of one engine, not as a fork. Let the model generate the test suite from the regulatory citations and then run thousands of synthetic enrollee scenarios against it, because the failure mode that ends a contract is a wrongful disenrollment that traces back to a logic bug, and a dense test harness is the cheapest insurance against that.
The unglamorous middle is the data plumbing, and it does not bend to clever prompting. Connecting to a state’s wage file, its existing eligibility system, SSA and SNAP and TANF feeds, and the managed-care encounter pipeline means real integration work against systems that are sometimes decades old, frequently undocumented, and wrapped in data-use agreements that take longer to sign than the code takes to write. The build needs strong identity resolution so a person is not flagged noncompliant because their labor-department record and their Medicaid record spell the name differently. It needs the document-handling and notice-generation flow, the bilingual and accessibility requirements, and a security posture that can survive a state CISO and an eventual federal review. The smart move is to build the rules engine and the verification orchestration as a clean, certifiable module that speaks standard interfaces, rather than trying to rip and replace the whole eligibility system, both because modularity is what the federal funding rules reward and because nobody is going to let a new vendor touch the system of record on day one. Claude Code accelerates roughly the front half of that and watches from the sidelines during the data agreements, the privacy review, and the procurement, which is fine, because the front half is the part that usually slips.
Section five. The money, who pays and how the 90/10 match rewrites the deal
The reason this market exists at all is that states almost never pay full freight for Medicaid systems, and the math is wildly in a vendor’s favor once you understand it. Under section 1903(a)(3) of the Social Security Act, the federal government covers 90 percent of the cost to design, develop, and install a qualifying Medicaid eligibility and enrollment system, the famous 90/10 match, and then 75 percent of the cost to operate and maintain it, the 75/25 match, provided the system meets CMS conditions and standards. So a state evaluating a verification module is really only spending ten cents of its own money on every dollar of build and a quarter on every dollar of ongoing operations. That is a very different buying psychology than a normal enterprise sale, and it is why these systems routinely cost far more than they should. The incumbents are not stupid, they are responding rationally to a buyer that is mostly spending someone else’s money.
On top of the standing match, CMS layered fresh incentives specifically for this rollout. The Working Families Tax Cut law put $200 million of Government Efficiency Grants on the table for state system modernization and administrative capacity, and CMS also announced more than $600 million in committed support from private-sector technology vendors to help states update eligibility and enrollment systems and run beneficiary outreach. That private-vendor money is worth reading carefully, because it tells you the big platform players have already decided to subsidize their way into these contracts and intend to make it back on operations and the next decade of change orders. For a smaller builder, the play is not to outspend that, it is to get a state to claim enhanced match on a certifiable module and to position the offering so the state’s own ten or twenty-five cents buys dramatically more verified throughput than the legacy approach. The funding mechanism is an Advance Planning Document, an APD, that the state submits to CMS to unlock the enhanced match, and getting named in or aligned to a state’s APD is the actual finish line. No APD, no enhanced match, no deal worth having.
Section six. Getting in the door, procurement and the awkward dance with the incumbents
Selling software to a state Medicaid agency is not selling software, it is surviving a procurement process designed by people who have been burned before and intend to make you prove you will not burn them again. The dominant vehicle is the RFP, often tied to an MMIS or eligibility-system reprocurement, and the named adversaries are familiar: Deloitte, Accenture, Gainwell, Conduent, and a short bench of regional systems integrators who have staffed state capitals for years and know every procurement officer by first name. A founder walking in cold against that field with a clever rules engine is going to lose the prime contract, full stop. The realistic entry is as a subcontractor or a certified module that an integrator or the state bolts onto the existing enterprise, which is precisely why CMS has spent a decade pushing modularity and modular certification, discouraging states from replacing an entire system as one monolithic project and letting them certify and claim enhanced match on individual modules as they go live. That modular posture is the small vendor’s friend, because it creates a legitimate slot for a single sharp component inside a larger system.
Speed and procurement vehicles matter more than elegance here. With a January 1, 2027 deadline and 43 states plus DC scrambling, the agencies that move fastest will lean on cooperative purchasing vehicles like NASPO ValuePoint and on existing contract vehicles to avoid a full open procurement they do not have time to run. Getting onto one of those vehicles, or partnering with someone already on one, can matter more than having the best demo. The other unglamorous truth is that the buyer is not one person. There is the Medicaid director who owns policy, the state CIO or the Medicaid Enterprise Systems officer who owns the technology and the APD, a procurement office that owns the rules, a budget office that cares about the ten-cent share, and increasingly a governor’s office that cares about the politics. A deal dies if any one of them is ignored. The pitch that lands is narrow and quantified: here is the ex parte match rate we can hit, here is the reduction in notices mailed and therefore in call-center load and wrongful disenrollments, here is how the module gets certified for enhanced match, and here is the timeline that beats your deadline. Vague platform talk is what loses to Deloitte, because Deloitte has more people to be vague with.
Section seven. The risks that can sink the whole thing
The first risk is legal, and it is not hypothetical. Work requirements have a long courtroom history, prior approvals got struck down, and the disenrollment mechanics in this rule are a litigation magnet. A vendor whose software generates a notice with the wrong date, miscounts hours, or wrongly fails to apply an exemption is not facing a bug ticket, it is facing a named plaintiff and a state agency desperate for someone to blame. That risk has to be engineered against from the first commit, with the rules logic traceable to specific regulatory citations, every determination logged in an audit-grade trail, and the notice and 30-day-cure flow built to satisfy due process rather than just to clear a demo. The political risk rides alongside it. Administrations change, a future CMS could soften enforcement or a court could pause the requirement, and a company whose entire existence depends on one rule surviving is a fragile company. The hedge is to build the underlying capability, ex parte verification, exemption determination, and eligibility-data orchestration, as something durable that serves renewals, redeterminations, and program integrity generally, so the business does not evaporate if the work requirement does.
The second cluster is executional and reputational. Georgia is the reminder that this category can produce a public spectacle, and a vendor associated with a high-cost, low-enrollment, headline-generating failure carries that scar into every future state conversation. Data security is a hard floor, since the system touches wage records, disability status, and treatment-program participation, and a breach in this context is both a HIPAA problem and a front-page problem. There is also a quieter ethical risk that smart operators should not wave away. The cheapest, most defensible, and frankly most marketable version of this software is the one that maximizes correct ex parte determinations so that working and exempt people keep their coverage without lifting a finger, rather than the version optimized to shed enrollees through paperwork friction. Those two products look similar in a demo and behave very differently in the field, and the second one is the one that ends up in a GAO report. Building the first is not just the decent choice, it is the one with the longer commercial life, because it is the only version a politically mixed set of states can all defend.
Section eight. The honest read on where the money actually is
The temptation is to imagine a single product sold 44 times, and that is not how this goes. The durable money is less in the flashy rules engine, which any competent team including the incumbents can eventually replicate, and more in the integration, the certification, and the operations tail that the 75/25 match keeps funding year after year. Whoever owns the data plumbing into a given state’s wage files, eligibility system, and encounter data owns the relationship, and that relationship throws off change orders every time CMS issues a clarification or the state elects a new optional exception. A realistic path for a small builder is to win a module in one or two states, ideally as a subcontractor to an integrator who needs exactly this piece and does not want to build it, prove an ex parte match rate and a cost-per-determination that embarrasses the Georgia numbers, get the thing certified, and then use that reference to move into the next states before the deadline crush fully clears. Claude Code makes the first build cheap enough that a tiny team can credibly show up with working software instead of slideware, which a few years ago was the gating constraint. It does not make the data agreements, the security review, or the procurement any faster, and pretending otherwise is how founders torch their runway.
The window is also narrower than it looks. The 43 affected states are not going to run 43 thoughtful procurements in 2026, they are going to panic-buy from whoever can credibly promise to be live by January 1, 2027, and most of them will default to the integrator already sitting in the building. The opening for a sharper, cheaper module exists precisely because that default produces Georgia-grade outcomes and at least some states, some budget offices, and some governors who do not want a coverage-loss scandal will go looking for a better answer. That is a real but unsentimental opportunity. It rewards the team that treats the rule as a permanent operational fact rather than a temporary political football, that builds for the auditor and the legal-aid attorney as much as for the procurement officer, and that is content to be the indispensable component inside someone else’s contract rather than the name on the door. The unglamorous, modular, deeply integrated, quietly correct version of this software is the one that gets paid for a decade. The splashy one ends up in a hearing.
A couple of things worth flagging before you publish. The dollar figures, the 43 states, the January 1, 2027 deadline, the 90/10 and 75/25 match, and the Georgia numbers are all from the CMS rule, the CMS framework release, and the GAO and ProPublica reporting, so they will hold up to your readers, but the Georgia totals have been reported in slightly different cuts ($86.9M total in the GAO frame, closer to $92M once consulting and legal are added), so pick one framing per sentence and you are clean. Runs about 3,400 words. If you want a version that leans harder into the build architecture for a more engineering-heavy audience, or one that foregrounds the litigation risk for a policy crowd, say the word and I’ll reshape it.​​​​​​​​​​​​​​​
​