🎧 Part I Podcast free on Apple Podcasts and Spotify.
🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Table of Contents
Six thousand people, 1.5 trillion dollars
Follow the money
The Blue plan dynasty nobody talks about
Incentives are destiny: how each contractor class gets paid
The Maximus machine
Getting in the door, and the SPARC cliff
Who is actually using AI, and who gets paid to deny care
Ninety six billion reasons this all matters
Abstract
CMS administers roughly $1.5T in annual health spending with ~6,000 federal employees. The gap is filled by contractors: $7.0B to $8.4B per year in obligations, FY2021 through FY2025.
Top recipients over five years: Maximus ($3.88B), GDIT ($2.54B), then the MAC operators (Palmetto $1.53B, Noridian $1.26B, NGS $1.23B, Novitas $1.22B).
Three affiliated BCBS of South Carolina entities (Palmetto GBA, CGS, Companion Data Services) pulled ~$718M in FY2025 combined, which would rank second behind only Maximus.
By product service code, CMS is now mostly an IT and professional services buyer. The “government health insurance programs” line is ~16% of spend.
Payment mechanism determines behavior: MACs on cost-plus-award-fee (neutral), RACs on contingency with clawbacks (aggressive), UPICs deliberately on cost-plus (no bounty hunting), QICs on fixed price per case, and now WISeR AI vendors on a percentage of averted spend.
WISeR survived a Congressional Review Act repeal vote in the Senate, which failed 46 to 50 in July 2026, and runs through 2031. Early Texas data: 62% algorithmic approval, 84% after physician review.
The SPARC IDIQ ($25B ceiling) stops taking new task orders in early 2027 with no announced replacement. Nobody in the trades is covering this.
Total improper payments across CMS programs in FY2025: ~$96B. Total CMS contract spend: $7.87B. Sit with that ratio.
Six thousand people, 1.5 trillion dollars
Start with the arithmetic that makes the whole thing possible, because it is genuinely funny. The Centers for Medicare and Medicaid Services moves about a trillion and a half dollars a year across Medicare, Medicaid, CHIP, and the ACA marketplaces. It does this with roughly six thousand federal employees. For scale, that is fewer people than a single large hospital system employs in revenue cycle. UnitedHealth Group has about 400,000 employees. CMS has a rounding error of that and somehow touches more health care dollars than anyone on earth.
The trick, of course, is that CMS does almost none of the actual work. It never has. When Congress created Medicare in 1965, the political deal required that the government not directly run claims operations, so the statute routed everything through private intermediaries, mostly Blue Cross plans and commercial insurers who already knew how to pay hospital bills. Sixty years later that design decision has metastasized into one of the most consequential and least examined contractor markets in the federal government. Somewhere between $7 billion and $8.4 billion a year flows out of CMS through contracts, and the companies receiving it decide which claims get paid, which providers get enrolled, which audits get opened, which appeals get overturned, and, as of January 2026, which prior authorization requests get flagged by an algorithm whose vendor earns a cut of the denials.
That last clause is not an exaggeration and it is where this piece is headed. But the destination only makes sense if you understand the machine it got bolted onto. So: a tour of the contractor state, with real numbers.
Follow the money
Pull CMS contract obligations from USAspending for award types A through D and you get a market that is big, boring, and stable, which in federal contracting is the highest compliment available. FY2021 came in at $7.04 billion, FY2022 at $7.25 billion, FY2023 at $7.37 billion, FY2024 spiked to $8.39 billion on a QIO contract cycle plus marketplace outreach plus infrastructure work landing in the same year, and FY2025 settled back to $7.87 billion. FY2026 sits at $5.59 billion through late August with the usual September obligation dump still to come, because nothing says fiscal discipline like a federal agency obligating a quarter of its annual spend in the last thirty days of the year.
For historical anchoring, GAO looked at this market back in 2017 and found CMS obligated about $7.2 billion in FY2016, up 40 percent from FY2012, with 97 percent going to services rather than goods. Two GAO findings from that review still describe the market perfectly. First, CMS competes its contracts at freakishly high rates: 96 percent of FY2016 obligations were competed versus 63 percent government-wide. Whatever else you want to say about this agency, it is not handing out sole-source candy. Second, and in direct tension with the first, 78 percent of those competed dollars flowed through cost-reimbursement and time-and-materials arrangements, which OMB classifies as high-risk because the contractor bears almost no cost exposure. So the market is intensely competitive to enter and remarkably comfortable once you are inside. Keep that combination in mind, it explains a lot of incumbent behavior.
Now the fun part: who gets it. Aggregate FY2021 through FY2025 and Maximus Federal Services is the runaway winner at $3.88 billion, nearly 50 percent more than second-place General Dynamics IT at $2.54 billion. Then comes the MAC tier: Palmetto GBA at $1.53 billion, Noridian at $1.26 billion, National Government Services at $1.23 billion, Novitas at $1.22 billion. Then a genuinely weird middle: IPG DXTRA, an advertising and PR conglomerate, at $1.10 billion for marketplace public education (yes, a billion dollars of healthcare.gov marketing), Serco at $1.00 billion for marketplace eligibility support, Carahsoft at $818 million for being Carahsoft, meaning a reseller and vehicle through which half the software in government gets bought, and Accenture Federal at $796 million for running the federally facilitated marketplace platform itself. Booz Allen, Leidos, CGS Administrators, Companion Data Services, and Softrams round out the top fifteen
.
The single most clarifying cut of the data, though, is not who gets paid but what the money is coded as. Break FY2025 obligations down by product service code and the top line is professional support services at $2.37 billion, followed by business application development at $1.56 billion. The category actually labeled government health insurance programs, meaning the claims administration work everyone pictures when they think of Medicare contracting, is $1.23 billion, about 16 percent of the total. Stack the IT categories together and they exceed $2.6 billion; professional services exceed $2.5 billion. The honest description of CMS’s procurement profile in 2026 is a mid-sized federal technology and consulting buyer that happens to administer the largest health insurance programs in human history. That reframing explains why GDIT, Accenture, Booz, and a bench of agile shops with names like Sparksoft and eSimplicity now sit alongside sixty-year-old Blue plan subsidiaries on the same recipient table. It also explains why every health tech founder who has ever tried to sell to CMS ends up learning FAR clause numbers against their will.
One more note from the contract-level data before moving on, because the turnover matters. TrailBlazer Health Enterprises, Cahaba, HighPoint Digital, and Lockheed Martin Services all held nine-figure CMS positions within recent memory and hold nothing now. Ventech ran a $794 million infrastructure position down to zero by FY2026. CSRA booked $197 million in FY2021 and vanished into GDIT. Incumbents lose recompetes constantly here. This is a concentrated market but not a static one, and the difference matters for anyone modeling entry.
The Blue plan dynasty nobody talks about
Here is a detail that deserves way more attention than it gets. Palmetto GBA, CGS Administrators, and Companion Data Services are all affiliated with BlueCross BlueShield of South Carolina, largely through its Celerian Group arm. Add up their FY2025 obligations, roughly $363 million plus $141 million plus $214 million, and you land near $718 million. If you treated the family as a single recipient, a nonprofit Blue plan headquartered in Columbia, South Carolina would rank second among all CMS contractors, behind only Maximus and ahead of General Dynamics.
This is not a scandal, to be clear. It is something more interesting: living institutional archaeology. The 1965 statute made Blue plans the original Medicare intermediaries, and while most of the industry drifted away from that business over the decades, BCBS of South Carolina compounded it. Sixty years of claims adjudication muscle memory, converted into a diversified government services operation spanning MAC jurisdictions, the CERT program, DME processing, and the data center infrastructure underneath other contractors’ work. Noridian traces to the North Dakota Blue plan, Novitas to Northeast Blues, WPS to Wisconsin Physicians Service, First Coast to Florida Blue. The whole MAC tier is basically the fossil record of 1965 with better cybersecurity requirements.
And it points at the real barrier to entry in this market, which is not capital and is not technology. It is the institutional knowledge of how Medicare fee-for-service claims actually adjudicate at scale, across twelve A/B MAC jurisdictions and four DME jurisdictions, serving 1.2 million enrolled providers, processing more than 1.1 billion claims a year (about 193 million Part A, 927 million Part B), and paying out roughly $460 billion in benefits to 33.9 million beneficiaries. Nobody has ever built that capability from scratch and won a MAC contract cold. The entities that hold it do not raise equity, do not face quarterly earnings calls, and can price patiently forever. That is the most durable moat in government health contracting and it belongs to a handful of nonprofits most people in health tech have never thought about for even one second.
Incentives are destiny: how each contractor class gets paid
If there is one analytical frame worth stealing from this whole exercise, it is this: in the CMS ecosystem, payment mechanism predicts behavior with almost embarrassing reliability. Every contractor class has its own compensation logic, and each logic produces exactly the conduct you would expect. Walk the ladder.
MACs run on cost-plus-award-fee. CMS reimburses allowable costs and layers on an award fee tied to written performance criteria: claims accuracy, call quality, provider satisfaction, Privacy Act hygiene. A representative recent award ran about $484 million on this basis, and contracts run seven years, one base plus six options, with MACRA permitting up to ten. The elegant thing about this structure is what it does not reward. A MAC does not profit from denying claims and does not profit from paying them. It profits from processing enormous volume accurately and scoring well on a rubric. Deliberately neutral, by design, and worth remembering as the baseline against which everything newer gets measured. CMS also caps any single contractor at 26 percent of national A/B workload, 40 percent across affiliates, though the Federal Circuit sided against that cap in the NGS litigation in 2019 and CMS just kind of kept publishing it anyway, which is a very CMS move. Meanwhile a September 2024 RFI floated consolidating Jurisdictions 5 and 6 into a new Jurisdiction G and 8 and 15 into a Jurisdiction Q, so the number of prime seats at this table may be shrinking.
Recovery Audit Contractors run on the opposite logic: contingency. A RAC earns a percentage of overpayments it identifies and CMS actually collects, historically 9 to 12.5 percent on most claims and up to 17.5 percent on DME, and it must hand the fee back if the determination gets overturned on appeal at any level. CMS bolts on guardrails, a sub-10-percent overturn requirement at first-level appeal and a 95 percent accuracy floor policed by an independent validation contractor, precisely because everyone understands what contingency compensation does to auditor psychology. The current map is freshly consolidated: Performant holds Regions 1 and 2, and in April 2025 Cotiviti swept Regions 3, 4, and 5, including the nationwide DME, home health, and hospice portfolio, for a combined base-plus-options value around $100 million, making it the dominant Medicare recovery auditor. Now hold the program’s actual scale in your head. In FY2023, RACs identified $353 million and recovered $273 million, against $31.2 billion in Medicare FFS improper payments that same year. The recovery apparatus captures under one percent of the leakage it exists to address. Whether that is program design, appeal-risk timidity, or the deliberately narrow audit scope CMS permits is a legitimately open question, but the gap between the rhetoric of payment integrity and $273 million of recoveries is a chasm
.
UPICs, the fraud investigators, are deliberately not on contingency, and the reason is stated almost out loud: a fraud investigator paid a percentage of recoveries chases collectible cases instead of serious ones. So Unified Program Integrity Contractors get cost-plus task orders sized to jurisdictional workload. CoventBridge holds the Midwest at $275 million, Qlarant holds West at $246 million and Southwest at $239 million, SafeGuard Services (a Peraton subsidiary) holds the Northeast and a $320 million Southeast. Fun corporate structure note: Qlarant Inc. is a nonprofit that runs its UPIC work through a for-profit subsidiary, so a nonprofit, a defense-adjacent tech giant, and a private investigations firm all compete for identical work under identical terms. Above them sits the CMS Center for Program Integrity with roughly a billion dollars and 500 staff.
Then the appeals layer, which is where the conflict-of-interest architecture gets genuinely baroque. Qualified Independent Contractors handle second-level appeals on firm-fixed-price delivery orders tied to case volume, with per-case fees undisclosed. Recent awards include $116.5 million to C2C Innovative Solutions for Part C QIC support and $33 million to Maximus for Part A West. Now the fine print. Q2Administrators, the administrative QIC that manages case files and training for the entire QIC system, is a wholly owned Maximus subsidiary, and Maximus is itself a QIC. GAO sustained a C2C protest on exactly this impaired-objectivity question back in 2018, finding CMS had not meaningfully considered the conflict. And C2C, for its part, is a subsidiary of TMF Health Quality Institute, a nonprofit that simultaneously holds QIN-QIO quality contracts and took $75 million from CMS in FY2025. The Medicare appeals system is adjudicated by subsidiaries of entities it reviews and by nonprofits with parallel CMS books of business. Everyone involved has a compliance memo explaining why this is fine.
Which brings the ladder to its newest rung. Under the WISeR model, CMS pays participants a percentage of the expenditures associated with averted care resulting from their reviews, adjusted for performance measures including provider experience. Read that again slowly. This is the RAC contingency logic, which the UPIC program was explicitly designed to avoid and which the RAC program itself hedges with clawbacks and overturn caps, transplanted from retrospective audit into prospective prior authorization, and handed not to auditors but to venture-backed AI companies. A private vendor’s revenue is now a direct function of how much Medicare spending its algorithm prevents. More on this in section seven, because the political fight over it is still warm.
The Maximus machine
No single company explains this market’s economics better than Maximus, partly because it is the biggest recipient and partly because, as a public company, it has to tell the truth about margins four times a year. NYSE ticker MMS, fiscal 2025 revenue of $5.43 billion, up 2.4 percent. The U.S. Federal Services segment, where the CMS work lives, grew 12.1 percent to $3.07 billion, and here is the number that matters: segment operating margin expanded from 12.2 percent to 15.3 percent in a single year. Free cash flow of $366 million, $457 million of buybacks, a $51.3 billion total pipeline with about two-thirds of it federal.
The flagship asset is the Contact Center Operations contract, awarded September 2022 after full and open competition, a transition base plus nine one-year options with a total value of $6.6 billion. It runs 1-800-MEDICARE and the marketplace call centers, over 35 million inquiries a year across ten domestic sites plus remote staff, with reported customer satisfaction of 95 percent for Medicare and 92 percent for the marketplace, wage determinations under the Service Contract Labor Standards, and a mandate to subcontract at least 15 percent to small business. Maximus got here through acquisition as much as competition: it was a sub to General Dynamics on CMS contact centers, then bought GD’s citizen engagement business outright for $400 million in 2018 and became the prime, then bought Attain’s federal division for $430 million in 2021 explicitly for the AI and ML bench.
Now watch the FY2026 guidance, because it is the cleanest AI-economics tell available anywhere in government services. Revenue guided to $5.225 to $5.425 billion, flat to slightly down. Adjusted EBITDA margin guided up to roughly 13.7 percent. CEO commentary about deploying AI-enabled automation to drive productivity and operating leverage into 2027. Translate from earnings-call: the AI thesis at Maximus is a cost thesis, not a revenue thesis. On labor-heavy contracts with fixed or cost-plus revenue, every call deflected to an agent copilot and every document parsed by a model converts directly into margin, and the customer, CMS, does not capture a dime of it inside the current contract period. The most concrete deployment Maximus discloses is for the No Surprises Act IDR process, where intelligent document processing plus an eligibility rules engine reportedly cleared a massive backlog, got median eligibility processing to two business days, and resolved up to 45 percent of disputes through automation. That is real, verified, and quietly the most instructive AI-in-government case study going, because the profit mechanics are visible in a 10-K instead of a press release.
Getting in the door, and the SPARC cliff
For the operators and founders in the audience, the practical question: how does anyone actually get into this market? The baseline is unglamorous. SAM.gov registration, UEI, CAGE code, a CPARS past-performance record you cannot have until someone gives you a contract you cannot win without one. For anything touching CMS systems or data, add FedRAMP for cloud, the CMS Acceptable Risk Safeguards, Section 508 conformance, and usually SOC 2 or HITRUST. Then plan for geologic time. The Contact Center Operations procurement went RFI in November 2019, solicitation in June 2021, award in September 2022. Nearly three years, followed by the customary bid protest, because on awards this size a GAO protest is basically a closing ceremony.
The historical workaround for the mid-tier was the vehicle system, and the crown jewel was SPARC, the Strategic Partners Acquisition Readiness Contract: a multiple-award IDIQ with a $25 billion ceiling, no administrative fee, open to all of HHS, covering the full software lifecycle, with small business set-asides and sole-source 8(a) awards under $4 million. An entire cohort of firms built real businesses on it. Softrams did $177 million with CMS in FY2025 and got acquired by Tria Federal. Sparksoft did $105 million and holds a $118 million prime for advanced provider screening. Index Analytics did $114 million including a $43 million No Surprises Act enforcement contract. SemanticBits got bought by ICF for $220 million. eSimplicity went from $7 million in FY2021 to $78 million in FY2025. This is what a functioning on-ramp looks like.
The on-ramp is closing. CMS states flatly that SPARC approaches the end of its ordering period in early 2027, that no new task orders will be awarded after that, and, in the sentence doing all the work, that there is no plan to replace it. Existing task orders run out their individual periods and then the pipeline is simply gone. Layer on Executive Order 14240 from March 2025 pushing common procurement toward GSA consolidation, plus more than 10,700 federal contract terminations in 2025 including over 60 at HHS, and the procurement architecture that built the CMS digital services mid-tier over the past decade is being dismantled in real time with no announced successor. For any firm whose CMS revenue is substantially SPARC task orders, this is an existential event about six months out, and the trade press has essentially not noticed. If a wave of mid-tier government health IT M&A shows up in 2027 looking like distressed consolidation, this paragraph is why.
Except there is one new door, and it is a strange one. The WISeR participants did not come through FAR procurement at all. They came through a Request for Applications issued by the CMS Innovation Center under its 1115A demonstration authority, which meant no CPARS history required, no incumbent relationships, no three-year procurement slog. CMS itself describes WISeR as a roadmap for incorporating more private sector innovation into CMS operations. For a venture-backed startup, an Innovation Center model application is now demonstrably a faster route into Medicare operations than the entire acquisition system. Whether that is a feature or a bypass of every safeguard the acquisition system exists to provide is, conveniently, the subject of the next section.
Who is actually using AI, and who gets paid to deny care
Strip the marketing and three distinct AI patterns are running inside this ecosystem, and they should never be discussed in the same breath even though every conference panel does exactly that.
Pattern one is the margin play, covered above: Maximus-style automation of labor-intensive work, converting headcount into operating leverage. Acentra Health, the Carlyle-built rollup of Kepro and CNSI that holds a $298 million BFCC-QIO contract across 29 states, offers the single most quantified production stat in the market: its AI correspondence engine drafted sections of over 65,000 determination letters in four months of 2024, cutting drafting time from six minutes thirty-five seconds to three minutes twenty-eight. Acentra also convened a Safe AI in Medicaid Alliance that grew to 32 states within a month, with the explicit framing that it does not compete on AI safety, which is of course itself a competitive strategy, and a pretty good one.
Pattern two is the detection play, and the biggest deployment belongs to CMS itself. The Center for Program Integrity’s fraud prevention system runs roughly 250 models a day to triage four to five million daily claims for a staff of about 500 humans. The acting CPI director reported a doubled ROI, about $14 returned per dollar spent fighting fraud in 2024, described the agency as having a much longer leash under the current administration, and estimated roughly $100 billion in fraud still uncaptured. A twice-weekly Medicare fraud war room reportedly saved almost $2 billion in under a year; the Medicaid version launched April 2026 and flagged 50 high-risk providers representing $203 million in its first 88 days, producing 42 federal exclusion notices. Cotiviti sits in this pattern too on the commercial side, with an AI governance committee since 2023 and a stated bright line that it does not use AI to make medical necessity determinations or deny care. Note the common thread: in the detection pattern, models prioritize human review. A human still decides. Even GAO’s witness at the same event stressed keeping the human in the loop. And Commence Health, the rebranded Livanta handling beneficiary discharge appeals, states outright that it uses no AI in case review at all, licensed physicians only. When a Medicare beneficiary appeals being discharged from a hospital bed, a person reads the file. Somebody at that company thought carefully about which side of history to file paperwork on.
Pattern three is the determination play, and it is genuinely different in kind. WISeR, the Wasteful and Inappropriate Service Reduction model, is the first Innovation Center model in which technology companies are the only participants. Six vendors, six states, each paired to a MAC jurisdiction: Cohere Health in Texas, Genzeon in New Jersey, Humata Health in Oklahoma, Innovaccer in Ohio, Virtix Health in Washington, Zyter in Arizona. It runs January 2026 through December 2031, applying prior authorization to a defined set of services CMS considers waste-prone, skin substitutes, electrical nerve stimulator implants, knee arthroscopy for osteoarthritis among them, while excluding inpatient-only, emergency, and time-sensitive care. CMS requires that all non-payment recommendations come from licensed clinicians and plans a gold-card exemption for well-behaved providers. And the vendors are compensated with a percentage of averted expenditures, adjusted for performance measures. Denial-linked revenue, prospective, algorithmic, in traditional Medicare, the one part of the system that was supposed to be the prior-auth-free control group.
The political record here reads like a thriller written by a FAR attorney. Forty-plus House members demanded a halt in mid-2025. Bills and defunding amendments failed in November. The model went live January 15, 2026. The Electronic Frontier Foundation sued under FOIA in March to see how the tools work. In April, a Washington state report from 16 hospitals found procedures taking two to four times as long, and CMS delayed two service categories for operational readiness. On May 12, GAO determined the model is a rule under the Congressional Review Act that should have been submitted to Congress, which teed up disapproval resolutions in both chambers. On July 16, 2026, the Senate rejected the resolution 46 to 50 on party lines. The model lives, through 2031. Meanwhile the early Texas numbers: roughly 62 percent of prior auth requests initially approved by the algorithmic screen, rising to 84 percent after physician review, against Medicare Advantage approval rates that typically clear 90. An algorithm whose vendor is paid on denials is currently approving at a lower rate than the MA plans everyone spent 2024 yelling about. The shared-savings percentages themselves are in participation agreements that are not public, which is exactly the kind of detail a FOIA suit exists to shake loose.
Ninety six billion reasons this all matters
Close with the ratio that reframes the entire market. CMS reported FY2025 Medicare fee-for-service improper payments at 6.55 percent, $28.8 billion, the ninth straight year under the statutory 10 percent threshold and down from $31.7 billion the year before. Good trend, genuinely. But stack every program: Part C at $23.7 billion and rising, Part D at $4.2 billion, Medicaid at $37.4 billion, CHIP at $1.4 billion, marketplace tax credits at $0.7 billion, and total improper payments across CMS programs in FY2025 approached $96 billion. The entire contractor apparatus described above, the MACs and RACs and UPICs and QICs and the AI vendors and the call centers and the cloud contracts, all of it together, costs $7.87 billion. The oversight machine is one twelfth the size of the leakage it polices, and its most aggressive component, the RAC program, recovers a few hundred million a year. Worth stating plainly, since the political framing never does: improper is not fraud. Seventy-seven percent of Medicaid improper payments trace to insufficient documentation, and the same is true for most of traditional Medicare’s number. A lot of that $96 billion is paperwork, not crime. But the gap between it and $273 million in RAC recoveries is the space in which every payment integrity pitch deck of the past decade was written, and now it is the space in which CMS is running a live experiment paying algorithms a commission on prevented spend.
So here is the shape of the whole thing. A six-thousand-person agency outsources the machinery of American health care to a market where a public company runs the phones at 15 percent margins and rising, a South Carolina Blue plan quietly operates the second-largest contracting family in the system on institutional memory from 1965, the appeals process is administered by a subsidiary of one of the parties being appealed, the mid-tier’s primary on-ramp closes in months with no replacement, and the newest entrants skipped the procurement system entirely and get paid a percentage of the care their models help avert. Every incentive in that sentence was chosen by someone, on purpose, at some point between 1965 and last July. Payment mechanism is destiny. CMS has spent sixty years proving it, one contractor class at a time, and the 46 to 50 vote means the newest proof runs through 2031. Watch the FOIA docket.