Thoughts on Healthcare Markets & Technology

Part I: The Contractor State: Who Actually Runs Medicare, How CMS Spends Its $8 Billion a Year, Why a South Carolina Blue Plan Quietly Banks $700 Million, and How AI Vendors Now Get Paid to Deny Care

CMS moves $1.5 trillion a year with 6,000 employees. It does almost none of the actual work. A contractor market of $7-8.5B a year does it for them…

Listen now

26 minutes ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Thoughts on Healthcare Markets & Technology

Part II: The Contractor State: Who Actually Runs Medicare, How CMS Spends Its $8 Billion a Year, Why a South Carolina Blue Plan Quietly Banks $700 Million, and How AI Vendors Now Get Paid to Deny Care

CMS moves $1.5 trillion a year with 6,000 employees. It does almost none of the actual work. A contractor market of $7-8.5B a year does it for them…

Listen now

25 minutes ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

Six thousand people, 1.5 trillion dollars

Follow the money

The Blue plan dynasty nobody talks about

Incentives are destiny: how each contractor class gets paid

The Maximus machine

Getting in the door, and the SPARC cliff

Who is actually using AI, and who gets paid to deny care

Ninety six billion reasons this all matters

Abstract

• CMS administers roughly $1.5T in annual health spending with ~6,000 federal employees. The gap is filled by contractors: $7.0B to $8.4B per year in obligations, FY2021 through FY2025.

• Top recipients over five years: Maximus ($3.88B), GDIT ($2.54B), then the MAC operators (Palmetto $1.53B, Noridian $1.26B, NGS $1.23B, Novitas $1.22B).

• Three affiliated BCBS of South Carolina entities (Palmetto GBA, CGS, Companion Data Services) pulled ~$718M in FY2025 combined, which would rank second behind only Maximus.

• By product service code, CMS is now mostly an IT and professional services buyer. The “government health insurance programs” line is ~16% of spend.

• Payment mechanism determines behavior: MACs on cost-plus-award-fee (neutral), RACs on contingency with clawbacks (aggressive), UPICs deliberately on cost-plus (no bounty hunting), QICs on fixed price per case, and now WISeR AI vendors on a percentage of averted spend.

• WISeR survived a Congressional Review Act repeal vote in the Senate, which failed 46 to 50 in July 2026, and runs through 2031. Early Texas data: 62% algorithmic approval, 84% after physician review.

• The SPARC IDIQ ($25B ceiling) stops taking new task orders in early 2027 with no announced replacement. Nobody in the trades is covering this.

• Total improper payments across CMS programs in FY2025: ~$96B. Total CMS contract spend: $7.87B. Sit with that ratio.

Six thousand people, 1.5 trillion dollars

Start with the arithmetic that makes the whole thing possible, because it is genuinely funny. The Centers for Medicare and Medicaid Services moves about a trillion and a half dollars a year across Medicare, Medicaid, CHIP, and the ACA marketplaces. It does this with roughly six thousand federal employees. For scale, that is fewer people than a single large hospital system employs in revenue cycle. UnitedHealth Group has about 400,000 employees. CMS has a rounding error of that and somehow touches more health care dollars than anyone on earth.

The trick, of course, is that CMS does almost none of the actual work. It never has. When Congress created Medicare in 1965, the political deal required that the government not directly run claims operations, so the statute routed everything through private intermediaries, mostly Blue Cross plans and commercial insurers who already knew how to pay hospital bills. Sixty years later that design decision has metastasized into one of the most consequential and least examined contractor markets in the federal government. Somewhere between $7 billion and $8.4 billion a year flows out of CMS through contracts, and the companies receiving it decide which claims get paid, which providers get enrolled, which audits get opened, which appeals get overturned, and, as of January 2026, which prior authorization requests get flagged by an algorithm whose vendor earns a cut of the denials.

That last clause is not an exaggeration and it is where this piece is headed. But the destination only makes sense if you understand the machine it got bolted onto. So: a tour of the contractor state, with real numbers.

Follow the money

Pull CMS contract obligations from USAspending for award types A through D and you get a market that is big, boring, and stable, which in federal contracting is the highest compliment available. FY2021 came in at $7.04 billion, FY2022 at $7.25 billion, FY2023 at $7.37 billion, FY2024 spiked to $8.39 billion on a QIO contract cycle plus marketplace outreach plus infrastructure work landing in the same year, and FY2025 settled back to $7.87 billion. FY2026 sits at $5.59 billion through late August with the usual September obligation dump still to come, because nothing says fiscal discipline like a federal agency obligating a quarter of its annual spend in the last thirty days of the year.

For historical anchoring, GAO looked at this market back in 2017 and found CMS obligated about $7.2 billion in FY2016, up 40 percent from FY2012, with 97 percent going to services rather than goods. Two GAO findings from that review still describe the market perfectly. First, CMS competes its contracts at freakishly high rates: 96 percent of FY2016 obligations were competed versus 63 percent government-wide. Whatever else you want to say about this agency, it is not handing out sole-source candy. Second, and in direct tension with the first, 78 percent of those competed dollars flowed through cost-reimbursement and time-and-materials arrangements, which OMB classifies as high-risk because the contractor bears almost no cost exposure. So the market is intensely competitive to enter and remarkably comfortable once you are inside. Keep that combination in mind, it explains a lot of incumbent behavior.

Now the fun part: who gets it. Aggregate FY2021 through FY2025 and Maximus Federal Services is the runaway winner at $3.88 billion, nearly 50 percent more than second-place General Dynamics IT at $2.54 billion. Then comes the MAC tier: Palmetto GBA at $1.53 billion, Noridian at $1.26 billion, National Government Services at $1.23 billion, Novitas at $1.22 billion. Then a genuinely weird middle: IPG DXTRA, an advertising and PR conglomerate, at $1.10 billion for marketplace public education (yes, a billion dollars of healthcare.gov marketing), Serco at $1.00 billion for marketplace eligibility support, Carahsoft at $818 million for being Carahsoft, meaning a reseller and vehicle through which half the software in government gets bought, and Accenture Federal at $796 million for running the federally facilitated marketplace platform itself. Booz Allen, Leidos, CGS Administrators, Companion Data Services, and Softrams round out the top fifteen

.

The single most clarifying cut of the data, though, is not who gets paid but what the money is coded as. Break FY2025 obligations down by product service code and the top line is professional support services at $2.37 billion, followed by business application development at $1.56 billion. The category actually labeled government health insurance programs, meaning the claims administration work everyone pictures when they think of Medicare contracting, is $1.23 billion, about 16 percent of the total. Stack the IT categories together and they exceed $2.6 billion; professional services exceed $2.5 billion. The honest description of CMS’s procurement profile in 2026 is a mid-sized federal technology and consulting buyer that happens to administer the largest health insurance programs in human history. That reframing explains why GDIT, Accenture, Booz, and a bench of agile shops with names like Sparksoft and eSimplicity now sit alongside sixty-year-old Blue plan subsidiaries on the same recipient table. It also explains why every health tech founder who has ever tried to sell to CMS ends up learning FAR clause numbers against their will.

One more note from the contract-level data before moving on, because the turnover matters. TrailBlazer Health Enterprises, Cahaba, HighPoint Digital, and Lockheed Martin Services all held nine-figure CMS positions within recent memory and hold nothing now. Ventech ran a $794 million infrastructure position down to zero by FY2026. CSRA booked $197 million in FY2021 and vanished into GDIT. Incumbents lose recompetes constantly here. This is a concentrated market but not a static one, and the difference matters for anyone modeling entry.

The Blue plan dynasty nobody talks about

Here is a detail that deserves way more attention than it gets. Palmetto GBA, CGS Administrators, and Companion Data Services are all affiliated with BlueCross BlueShield of South Carolina, largely through its Celerian Group arm. Add up their FY2025 obligations, roughly $363 million plus $141 million plus $214 million, and you land near $718 million. If you treated the family as a single recipient, a nonprofit Blue plan headquartered in Columbia, South Carolina would rank second among all CMS contractors, behind only Maximus and ahead of General Dynamics.

This is not a scandal, to be clear. It is something more interesting: living institutional archaeology. The 1965 statute made Blue plans the original Medicare intermediaries, and while most of the industry drifted away from that business over the decades, BCBS of South Carolina compounded it. Sixty years of claims adjudication muscle memory, converted into a diversified government services operation spanning MAC jurisdictions, the CERT program, DME processing, and the data center infrastructure underneath other contractors’ work. Noridian traces to the North Dakota Blue plan, Novitas to Northeast Blues, WPS to Wisconsin Physicians Service, First Coast to Florida Blue. The whole MAC tier is basically the fossil record of 1965 with better cybersecurity requirements.

And it points at the real barrier to entry in this market, which is not capital and is not technology. It is the institutional knowledge of how Medicare fee-for-service claims actually adjudicate at scale, across twelve A/B MAC jurisdictions and four DME jurisdictions, serving 1.2 million enrolled providers, processing more than 1.1 billion claims a year (about 193 million Part A, 927 million Part B), and paying out roughly $460 billion in benefits to 33.9 million beneficiaries. Nobody has ever built that capability from scratch and won a MAC contract cold. The entities that hold it do not raise equity, do not face quarterly earnings calls, and can price patiently forever. That is the most durable moat in government health contracting and it belongs to a handful of nonprofits most people in health tech have never thought about for even one second.

Incentives are destiny: how each contractor class gets paid

If there is one analytical frame worth stealing from this whole exercise, it is this: in the CMS ecosystem, payment mechanism predicts behavior with almost embarrassing reliability. Every contractor class has its own compensation logic, and each logic produces exactly the conduct you would expect. Walk the ladder.

MACs run on cost-plus-award-fee. CMS reimburses allowable costs and layers on an award fee tied to written performance criteria: claims accuracy, call quality, provider satisfaction, Privacy Act hygiene. A representative recent award ran about $484 million on this basis, and contracts run seven years, one base plus six options, with MACRA permitting up to ten. The elegant thing about this structure is what it does not reward. A MAC does not profit from denying claims and does not profit from paying them. It profits from processing enormous volume accurately and scoring well on a rubric. Deliberately neutral, by design, and worth remembering as the baseline against which everything newer gets measured. CMS also caps any single contractor at 26 percent of national A/B workload, 40 percent across affiliates, though the Federal Circuit sided against that cap in the NGS litigation in 2019 and CMS just kind of kept publishing it anyway, which is a very CMS move. Meanwhile a September 2024 RFI floated consolidating Jurisdictions 5 and 6 into a new Jurisdiction G and 8 and 15 into a Jurisdiction Q, so the number of prime seats at this table may be shrinking.

Recovery Audit Contractors run on the opposite logic: contingency. A RAC earns a percentage of overpayments it identifies and CMS actually collects, historically 9 to 12.5 percent on most claims and up to 17.5 percent on DME, and it must hand the fee back if the determination gets overturned on appeal at any level. CMS bolts on guardrails, a sub-10-percent overturn requirement at first-level appeal and a 95 percent accuracy floor policed by an independent validation contractor, precisely because everyone understands what contingency compensation does to auditor psychology. The current map is freshly consolidated: Performant holds Regions 1 and 2, and in April 2025 Cotiviti swept Regions 3, 4, and 5, including the nationwide DME, home health, and hospice portfolio, for a combined base-plus-options value around $100 million, making it the dominant Medicare recovery auditor. Now hold the program’s actual scale in your head. In FY2023, RACs identified $353 million and recovered $273 million, against $31.2 billion in Medicare FFS improper payments that same year. The recovery apparatus captures under one percent of the leakage it exists to address. Whether that is program design, appeal-risk timidity, or the deliberately narrow audit scope CMS permits is a legitimately open question, but the gap between the rhetoric of payment integrity and $273 million of recoveries is a chasm

.

UPICs, the fraud investigators, are deliberately not on contingency, and the reason is stated almost out loud: a fraud investigator paid a percentage of recoveries chases collectible cases instead of serious ones. So Unified Program Integrity Contractors get cost-plus task orders sized to jurisdictional workload. CoventBridge holds the Midwest at $275 million, Qlarant holds West at $246 million and Southwest at $239 million, SafeGuard Services (a Peraton subsidiary) holds the Northeast and a $320 million Southeast. Fun corporate structure note: Qlarant Inc. is a nonprofit that runs its UPIC work through a for-profit subsidiary, so a nonprofit, a defense-adjacent tech giant, and a private investigations firm all compete for identical work under identical terms. Above them sits the CMS Center for Program Integrity with roughly a billion dollars and 500 staff.

Then the appeals layer, which is where the conflict-of-interest architecture gets genuinely baroque. Qualified Independent Contractors handle second-level appeals on firm-fixed-price delivery orders tied to case volume, with per-case fees undisclosed. Recent awards include $116.5 million to C2C Innovative Solutions for Part C QIC support and $33 million to Maximus for Part A West. Now the fine print. Q2Administrators, the administrative QIC that manages case files and training for the entire QIC system, is a wholly owned Maximus subsidiary, and Maximus is itself a QIC. GAO sustained a C2C protest on exactly this impaired-objectivity question back in 2018, finding CMS had not meaningfully considered the conflict. And C2C, for its part, is a subsidiary of TMF Health Quality Institute, a nonprofit that simultaneously holds QIN-QIO quality contracts and took $75 million from CMS in FY2025. The Medicare appeals system is adjudicated by subsidiaries of entities it reviews and by nonprofits with parallel CMS books of business. Everyone involved has a compliance memo explaining why this is fine.

Which brings the ladder to its newest rung. Under the WISeR model, CMS pays participants a percentage of the expenditures associated with averted care resulting from their reviews, adjusted for performance measures including provider experience. Read that again slowly. This is the RAC contingency logic, which the UPIC program was explicitly designed to avoid and which the RAC program itself hedges with clawbacks and overturn caps, transplanted from retrospective audit into prospective prior authorization, and handed not to auditors but to venture-backed AI companies. A private vendor’s revenue is now a direct function of how much Medicare spending its algorithm prevents. More on this in section seven, because the political fight over it is still warm.

The Maximus machine

No single company explains this market’s economics better than Maximus, partly because it is the biggest recipient and partly because, as a public company, it has to tell the truth about margins four times a year. NYSE ticker MMS, fiscal 2025 revenue of $5.43 billion, up 2.4 percent. The U.S. Federal Services segment, where the CMS work lives, grew 12.1 percent to $3.07 billion, and here is the number that matters: segment operating margin expanded from 12.2 percent to 15.3 percent in a single year. Free cash flow of $366 million, $457 million of buybacks, a $51.3 billion total pipeline with about two-thirds of it federal.

The flagship asset is the Contact Center Operations contract, awarded September 2022 after full and open competition, a transition base plus nine one-year options with a total value of $6.6 billion. It runs 1-800-MEDICARE and the marketplace call centers, over 35 million inquiries a year across ten domestic sites plus remote staff, with reported customer satisfaction of 95 percent for Medicare and 92 percent for the marketplace, wage determinations under the Service Contract Labor Standards, and a mandate to subcontract at least 15 percent to small business. Maximus got here through acquisition as much as competition: it was a sub to General Dynamics on CMS contact centers, then bought GD’s citizen engagement business outright for $400 million in 2018 and became the prime, then bought Attain’s federal division for $430 million in 2021 explicitly for the AI and ML bench.

Now watch the FY2026 guidance, because it is the cleanest AI-economics tell available anywhere in government services. Revenue guided to $5.225 to $5.425 billion, flat to slightly down. Adjusted EBITDA margin guided up to roughly 13.7 percent. CEO commentary about deploying AI-enabled automation to drive productivity and operating leverage into 2027. Translate from earnings-call: the AI thesis at Maximus is a cost thesis, not a revenue thesis. On labor-heavy contracts with fixed or cost-plus revenue, every call deflected to an agent copilot and every document parsed by a model converts directly into margin, and the customer, CMS, does not capture a dime of it inside the current contract period. The most concrete deployment Maximus discloses is for the No Surprises Act IDR process, where intelligent document processing plus an eligibility rules engine reportedly cleared a massive backlog, got median eligibility processing to two business days, and resolved up to 45 percent of disputes through automation. That is real, verified, and quietly the most instructive AI-in-government case study going, because the profit mechanics are visible in a 10-K instead of a press release.

Getting in the door, and the SPARC cliff

For the operators and founders in the audience, the practical question: how does anyone actually get into this market? The baseline is unglamorous. SAM.gov registration, UEI, CAGE code, a CPARS past-performance record you cannot have until someone gives you a contract you cannot win without one. For anything touching CMS systems or data, add FedRAMP for cloud, the CMS Acceptable Risk Safeguards, Section 508 conformance, and usually SOC 2 or HITRUST. Then plan for geologic time. The Contact Center Operations procurement went RFI in November 2019, solicitation in June 2021, award in September 2022. Nearly three years, followed by the customary bid protest, because on awards this size a GAO protest is basically a closing ceremony.

The historical workaround for the mid-tier was the vehicle system, and the crown jewel was SPARC, the Strategic Partners Acquisition Readiness Contract: a multiple-award IDIQ with a $25 billion ceiling, no administrative fee, open to all of HHS, covering the full software lifecycle, with small business set-asides and sole-source 8(a) awards under $4 million. An entire cohort of firms built real businesses on it. Softrams did $177 million with CMS in FY2025 and got acquired by Tria Federal. Sparksoft did $105 million and holds a $118 million prime for advanced provider screening. Index Analytics did $114 million including a $43 million No Surprises Act enforcement contract. SemanticBits got bought by ICF for $220 million. eSimplicity went from $7 million in FY2021 to $78 million in FY2025. This is what a functioning on-ramp looks like.

The on-ramp is closing. CMS states flatly that SPARC approaches the end of its ordering period in early 2027, that no new task orders will be awarded after that, and, in the sentence doing all the work, that there is no plan to replace it. Existing task orders run out their individual periods and then the pipeline is simply gone. Layer on Executive Order 14240 from March 2025 pushing common procurement toward GSA consolidation, plus more than 10,700 federal contract terminations in 2025 including over 60 at HHS, and the procurement architecture that built the CMS digital services mid-tier over the past decade is being dismantled in real time with no announced successor. For any firm whose CMS revenue is substantially SPARC task orders, this is an existential event about six months out, and the trade press has essentially not noticed. If a wave of mid-tier government health IT M&A shows up in 2027 looking like distressed consolidation, this paragraph is why.

Except there is one new door, and it is a strange one. The WISeR participants did not come through FAR procurement at all. They came through a Request for Applications issued by the CMS Innovation Center under its 1115A demonstration authority, which meant no CPARS history required, no incumbent relationships, no three-year procurement slog. CMS itself describes WISeR as a roadmap for incorporating more private sector innovation into CMS operations. For a venture-backed startup, an Innovation Center model application is now demonstrably a faster route into Medicare operations than the entire acquisition system. Whether that is a feature or a bypass of every safeguard the acquisition system exists to provide is, conveniently, the subject of the next section.

Who is actually using AI, and who gets paid to deny care

Strip the marketing and three distinct AI patterns are running inside this ecosystem, and they should never be discussed in the same breath even though every conference panel does exactly that.

Pattern one is the margin play, covered above: Maximus-style automation of labor-intensive work, converting headcount into operating leverage. Acentra Health, the Carlyle-built rollup of Kepro and CNSI that holds a $298 million BFCC-QIO contract across 29 states, offers the single most quantified production stat in the market: its AI correspondence engine drafted sections of over 65,000 determination letters in four months of 2024, cutting drafting time from six minutes thirty-five seconds to three minutes twenty-eight. Acentra also convened a Safe AI in Medicaid Alliance that grew to 32 states within a month, with the explicit framing that it does not compete on AI safety, which is of course itself a competitive strategy, and a pretty good one.

Pattern two is the detection play, and the biggest deployment belongs to CMS itself. The Center for Program Integrity’s fraud prevention system runs roughly 250 models a day to triage four to five million daily claims for a staff of about 500 humans. The acting CPI director reported a doubled ROI, about $14 returned per dollar spent fighting fraud in 2024, described the agency as having a much longer leash under the current administration, and estimated roughly $100 billion in fraud still uncaptured. A twice-weekly Medicare fraud war room reportedly saved almost $2 billion in under a year; the Medicaid version launched April 2026 and flagged 50 high-risk providers representing $203 million in its first 88 days, producing 42 federal exclusion notices. Cotiviti sits in this pattern too on the commercial side, with an AI governance committee since 2023 and a stated bright line that it does not use AI to make medical necessity determinations or deny care. Note the common thread: in the detection pattern, models prioritize human review. A human still decides. Even GAO’s witness at the same event stressed keeping the human in the loop. And Commence Health, the rebranded Livanta handling beneficiary discharge appeals, states outright that it uses no AI in case review at all, licensed physicians only. When a Medicare beneficiary appeals being discharged from a hospital bed, a person reads the file. Somebody at that company thought carefully about which side of history to file paperwork on.

Pattern three is the determination play, and it is genuinely different in kind. WISeR, the Wasteful and Inappropriate Service Reduction model, is the first Innovation Center model in which technology companies are the only participants. Six vendors, six states, each paired to a MAC jurisdiction: Cohere Health in Texas, Genzeon in New Jersey, Humata Health in Oklahoma, Innovaccer in Ohio, Virtix Health in Washington, Zyter in Arizona. It runs January 2026 through December 2031, applying prior authorization to a defined set of services CMS considers waste-prone, skin substitutes, electrical nerve stimulator implants, knee arthroscopy for osteoarthritis among them, while excluding inpatient-only, emergency, and time-sensitive care. CMS requires that all non-payment recommendations come from licensed clinicians and plans a gold-card exemption for well-behaved providers. And the vendors are compensated with a percentage of averted expenditures, adjusted for performance measures. Denial-linked revenue, prospective, algorithmic, in traditional Medicare, the one part of the system that was supposed to be the prior-auth-free control group.

The political record here reads like a thriller written by a FAR attorney. Forty-plus House members demanded a halt in mid-2025. Bills and defunding amendments failed in November. The model went live January 15, 2026. The Electronic Frontier Foundation sued under FOIA in March to see how the tools work. In April, a Washington state report from 16 hospitals found procedures taking two to four times as long, and CMS delayed two service categories for operational readiness. On May 12, GAO determined the model is a rule under the Congressional Review Act that should have been submitted to Congress, which teed up disapproval resolutions in both chambers. On July 16, 2026, the Senate rejected the resolution 46 to 50 on party lines. The model lives, through 2031. Meanwhile the early Texas numbers: roughly 62 percent of prior auth requests initially approved by the algorithmic screen, rising to 84 percent after physician review, against Medicare Advantage approval rates that typically clear 90. An algorithm whose vendor is paid on denials is currently approving at a lower rate than the MA plans everyone spent 2024 yelling about. The shared-savings percentages themselves are in participation agreements that are not public, which is exactly the kind of detail a FOIA suit exists to shake loose.

Ninety six billion reasons this all matters

Close with the ratio that reframes the entire market. CMS reported FY2025 Medicare fee-for-service improper payments at 6.55 percent, $28.8 billion, the ninth straight year under the statutory 10 percent threshold and down from $31.7 billion the year before. Good trend, genuinely. But stack every program: Part C at $23.7 billion and rising, Part D at $4.2 billion, Medicaid at $37.4 billion, CHIP at $1.4 billion, marketplace tax credits at $0.7 billion, and total improper payments across CMS programs in FY2025 approached $96 billion. The entire contractor apparatus described above, the MACs and RACs and UPICs and QICs and the AI vendors and the call centers and the cloud contracts, all of it together, costs $7.87 billion. The oversight machine is one twelfth the size of the leakage it polices, and its most aggressive component, the RAC program, recovers a few hundred million a year. Worth stating plainly, since the political framing never does: improper is not fraud. Seventy-seven percent of Medicaid improper payments trace to insufficient documentation, and the same is true for most of traditional Medicare’s number. A lot of that $96 billion is paperwork, not crime. But the gap between it and $273 million in RAC recoveries is the space in which every payment integrity pitch deck of the past decade was written, and now it is the space in which CMS is running a live experiment paying algorithms a commission on prevented spend.

So here is the shape of the whole thing. A six-thousand-person agency outsources the machinery of American health care to a market where a public company runs the phones at 15 percent margins and rising, a South Carolina Blue plan quietly operates the second-largest contracting family in the system on institutional memory from 1965, the appeals process is administered by a subsidiary of one of the parties being appealed, the mid-tier’s primary on-ramp closes in months with no replacement, and the newest entrants skipped the procurement system entirely and get paid a percentage of the care their models help avert. Every incentive in that sentence was chosen by someone, on purpose, at some point between 1965 and last July. Payment mechanism is destiny. CMS has spent sixty years proving it, one contractor class at a time, and the 46 to 50 vote means the newest proof runs through 2031. Watch the FOIA docket.

Maximus leads five-year contract totals at nearly $4B. But the most surprising #2: a nonprofit Blue plan in South Carolina, through three affiliated entities, pulling $718M in fiscal 2025 alone.

The entire Me…

Read more

Maximus leads five-year contract totals at nearly $4B. But the most surprising #2: a nonprofit Blue plan in South Carolina, through three affiliated entities, pulling $718M in fiscal 2025 alone.

The entire Medicare Administrative Contractor tier traces back to the 1965 statute that barred the government from running claims directly. Palmetto, Noridian, Novitas - all fossil records of that one political deal.

Most clarifying data point: only 16% of fiscal 2025 CMS contract spend is coded as government health insurance programs. The rest is IT and professional services. CMS is a federal tech buyer that happens to run Medicare.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

🎧 Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Thoughts on Healthcare Markets & Technology

How Epic Systems Makes Money: Inside the License, Maintenance, and Implementation Machine Powering Healthcare's Most Secretive Private Software Empire, From Verona to Cosmos to the Agentic Turn

Epic Systems earns roughly $6.7B a year. No outside investors. No acquisitions in 45 years. No IPO planned. It sells one type of software to one industry. And it may have the strongest switching-cost moat in enterprise software. Here is how the model actually works…

Listen now

17 hours ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of contents:

The short answer

Revenue streams in detail

Why the model is unusual

Revenue estimates

The agentic turn

FAQ

Abstract

• Epic makes money the boring way: software licenses, long-term maintenance contracts, implementation and hosting fees, all paid by health systems locked into 15+ year relationships

• Revenue is roughly $6.7B and growing high single to low double digits annually, with no VC, no debt, no acquisitions, and no exit ever

• The real story is the second-order stuff: Community Connect resale, Payer Platform, Cosmos, and MyChart as a strategic asset rather than a revenue line

• The switching-cost moat is arguably the strongest in enterprise software, and the AI agent wave is the first genuine test of whether that moat extends upward into the application layer

• Includes revenue estimates by year, market share stats, and answers to the questions everyone Googles about Judy Faulkner’s company

  Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

The short answer

Epic makes money by selling electronic health record software licenses to hospitals and health systems, then charging annual maintenance on those licenses, plus implementation fees, hosting fees, and a growing menu of add-on modules. That is the whole engine. No ads, no data sales, no venture capital, no public shareholders. The company is private, founder-controlled, has never acquired another company, has never taken outside investment, and has stated repeatedly that it never will. Judy Faulkner started it in a Madison basement in 1979 with about $70,000, mostly from friends and family, and still runs it. Revenue is now in the neighborhood of $6.7 billion a year, which means a company that sells one category of software to one industry in mostly one country out-earns a decent chunk of the S&P 500’s software names, while operating out of a farm-themed campus in Verona, Wisconsin with an underground auditorium bigger than most NBA arenas’ seating bowls.

The reason this deserves a full breakdown rather than a paragraph is that the simplicity is deceptive. License plus maintenance is the visible layer. Underneath it sits a set of mechanisms, Community Connect resale, the Payer Platform, Cosmos, MyChart’s consumer lock-in, that make Epic less a software vendor and more a utility with pricing power. Health systems do not really buy Epic. They convert to it, the way a country converts to a new rail gauge. And once the rails are down, the toll booth compounds.

Revenue streams in detail

Read more

The license fee is almost the loss leader. The business is the annual maintenance contrac…

Read more

🎧 Part I Podcast free on Apple Podcasts and Spotify.

Thoughts on Healthcare Markets & Technology

Part I: How Hippocratic AI Makes Money: The Nine Dollar Agent Hour, Who Actually Signs The Check At A Health System, And Whether A 3.5 Billion Dollar Valuation Survives Contact With Nursing Budgets

Hippocratic AI charges $9 per agent hour of patient conversation. Not per seat. Not per license. Hours. That one pricing decision changes everything about who buys, how fast deals close, and what the margin story looks like…

Listen now

a day ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.

Thoughts on Healthcare Markets & Technology

Part II: How Hippocratic AI Makes Money: The Nine Dollar Agent Hour, Who Actually Signs The Check At A Health System, And Whether A 3.5 Billion Dollar Valuation Survives Contact With Nursing Budgets

Hippocratic AI charges $9 per agent hour of patient conversation. Not per seat. Not per license. Hours. That one pricing decision changes everything about who buys, how fast deals close, and what the margin story looks like…

Listen now

a day ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. The short answer on how the money works

2. What the company actually sells

3. Pricing against labor instead of against software

4. The unit economics hiding under nine dollars

5. Funding, valuation, and the revenue gap nobody wants to name

6. How the deals actually get done

7. Safety as the moat and safety as the tax

8. The regulatory box the model has to stay inside

9. The app store, the life sciences turn, and the second S curve

10. What breaks it

    Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Abstract

• Hippocratic AI sells patient-facing voice AI agents to health systems, payers, and now pharma, priced at roughly $9 per agent hour of active patient conversation rather than per seat or per license.

• The pitch is labor arbitrage, not software savings. The comparison point is a registered nurse at roughly $45 an hour of base wage and closer to $60 fully loaded, or an outsourced call center at $15 to $25.

• Total raised is about $444M across six rounds. The November 3, 2025 Series C put in $126M at a $3.5B post-money valuation, led by Avenir Growth with CapitalG joining, after a $1.64B mark in January 2025.

• Third-party trackers peg revenue in the mid teens of millions, which would put the multiple somewhere north of 200x. The company does not disclose. Treat every ARR number you see as an estimate with a wide error bar.

• Company-reported volume: more than 250 million patient interactions by August 2026, up from more than 180 million in April 2026, with claimed ~99.90% correct clinical advice, zero severe harm events, and validation from more than 7,500 US-licensed clinicians.

• Six health systems sit on the cap table, which is the actual distribution strategy dressed up as a financing strategy.

• 2026 moves: acquired Grove AI in January for clinical trial recruitment and life sciences agents, launched AI Front Door and Nurse Co-Pilot in April, and built a life sciences division with a BCG collaboration.

• Main risks: gross margin under the safety apparatus, the EHR vendor bundling the same functionality for free, a state regulatory patchwork that is tightening fast, and 225,000 unionized nurses who have noticed.

The short answer on how the money works

Hippocratic AI makes money by selling hours. Not seats, not licenses, not per-member-per-month. Health systems, payers, and pharma companies buy blocks of AI agent time, priced at about nine dollars per agent hour, and they pay for the minutes the agent is actually on the phone with a patient doing something useful. Post-discharge follow-up calls, chronic care check-ins, pre-op prep, medication adherence nudges, appointment scheduling, benefits navigation. The agent talks, the clock runs, the invoice reflects the clock. That is the entire commercial model in one sentence, and it is the most interesting thing about the company, because it is not a software business model at all. It is a staffing business model with a compute cost structure, which is a genuinely new animal in health IT and explains both the valuation and the skepticism.

Everything else, the safety architecture, the app store, the clinician revenue share, the life sciences division, is either a way to justify charging that nine dollars or a way to sell more hours to a different buyer.

What the company actually sells

The founding story is worth about thirty seconds. Munjal Shah started the company in 2023 in Palo Alto after selling Like.com to Google and then running Health IQ, which gave him the useful combination of knowing how to build a consumer internet company and knowing how badly health insurance distribution works. He brought along a co-founding group drawn from Stanford, Johns Hopkins, El Camino Health, Microsoft, Google, and NVIDIA, including Vishal Parikh on product and Meenesh Bhimani on the clinical side. Shae McLaughlin now shares the CEO title.

The product is a constellation of models the company calls Polaris, which is the part that matters technically. Rather than one large model talking to a patient, Polaris runs a primary conversational model with a set of specialist support models checking it in real time on medication interactions, lab value interpretation, clinical guidelines, dietary rules, hospital policy, and so on. The support models are the safety layer, and the whole thing has to run fast enough that the patient does not notice a pause, which is why NVIDIA showed up on the cap table early. Voice latency is the difference between a call that feels like a person and a call that feels like a phone tree with a personality disorder.

The agents themselves are branded and named and each one has a job. There is a discharge agent, a chronic care agent, a pre-op agent, a trials recruitment agent named Grace that came in with the Grove acquisition. As of April 2026 there are two newer product lines. AI Front Door is a swing at replacing the entire patient access call center with a single omni-topic agent that can move from scheduling to lab results to a billing question inside one conversation and remember the previous four calls, which is more than most human call centers manage. Nurse Co-Pilot is the more strategically interesting one: it is aimed at inpatient bedside nurses, co-developed with Cincinnati Children's, OhioHealth, and Cleveland Clinic, and it lets a nurse fire off an AI call from inside the EHR to handle admission education or caregiver instructions, with the structured summary flowing back into the chart. The claim is one to four hours of nursing time returned per shift.

The critical constraint, stated everywhere in the company’s own materials and repeated in every contract, is that the agents are non-diagnostic. They do not diagnose, they do not prescribe, they do not triage in a way that constitutes a medical decision. That is not modesty. That is regulatory positioning, and it is load-bearing. More on that below.

Pricing against labor instead of against software

Here is where the model gets fun. Every SaaS vendor in healthcare prices against other software, which is why every health IT budget conversation devolves into a comparison of per-provider-per-month rates and a fight over whether the module is included. Hippocratic priced against people, and specifically against people the buyer cannot hire.

Run the comparison the way a CFO runs it. Median registered nurse pay in the US sits around ninety-three thousand a year, call it forty-five dollars an hour of base wage. Load that with benefits, payroll taxes, PTO coverage, and the overhead allocation and you are at fifty-five to sixty-five dollars an hour of true cost. Agency and travel nursing bill rates, which spiked past a hundred dollars an hour during the worst of the post-pandemic staffing crunch and settled back into the sixty to eighty range, are worse. An offshore or domestic BPO call center running non-clinical outreach costs fifteen to twenty-five dollars an hour, and even that is a real budget line at scale. Against that spread, nine dollars an hour is not a price, it is a provocation. It is designed to make the procurement math take about four seconds.

The consequence is that the buying committee changes. Ambient scribing gets sold to a CMIO with a physician burnout mandate. Hippocratic gets sold to a chief nursing officer with an open req problem, a COO with a call abandonment rate, and a VP of population health who owns a quality gap. Those people have operating budgets, not IT budgets, and operating budgets for labor are enormous compared to what health systems spend on point solutions. A system spending eighty million a year on nursing labor and forty million on outsourced patient outreach does not need a business case with a discount rate to justify a pilot. That is the structural advantage of pricing against labor, and it is why the deals close faster than health IT deals normally close. Twenty-three contracts in twenty-three weeks, sixteen of them live, was the number the company put out at the start of 2025, and nobody in health IT signs twenty-three enterprise contracts in twenty-three weeks unless they have found a budget that is not the IT budget.

The second consequence is that the ROI story does not depend on reimbursement, which is unusual and good. There is no CPT code for an AI agent, no HCPCS entry, no way to bill Medicare for a machine calling a patient. But the money shows up anyway, through the side door. Readmission penalties under the Hospital Readmissions Reduction Program can take up to three percent of base Medicare inpatient payments, and post-discharge outreach is the single most studied intervention against readmission. Chronic care management and transitional care management codes pay for structured contact, and if an agent does the outreach and a nurse reviews and attests, the time can support billing that would otherwise never happen because nobody had the staff. Medicare Advantage plans have star ratings and HEDIS gap closure that translate directly into premium dollars, and gap closure is a phone call problem more than a clinical problem. Every one of those is a revenue or penalty-avoidance line that a finance team can model without waiting for CMS to invent a payment pathway.

The unit economics hiding under nine dollars

Now the part that determines whether this is a software company or a services company wearing a software company’s valuation.

Start with what nine dollars an hour actually bills. A ten-minute post-discharge call generates a dollar fifty. A three-minute medication adherence check generates forty-five cents. This is a business of very small transactions repeated at absurd volume, which means the entire enterprise rests on the cost of a conversational minute.

The cost stack for a voice agent breaks into four pieces. Telephony is nearly free, a fraction of a cent per minute. Speech recognition runs well under a cent per minute at scale. Text to speech is the first real cost, anywhere from a cent to several cents per minute depending on how good the voice needs to sound, and for a company whose entire differentiation is that elderly patients find the agent warm and trustworthy, they are not buying the cheap voice. Then there is inference, which is where the constellation architecture cuts both ways. If a primary model handles the conversational turn and a dozen specialist models check its work before it speaks, the token cost per turn is multiplied by roughly a dozen. The safety architecture that justifies the price also inflates the COGS.

Run a generous estimate and a pessimistic one. Generous: an efficiently served small specialist model stack, aggressive caching, cheap TTS, and a ten-minute call costs fifteen to twenty-five cents to deliver. That is a gross margin in the eighty-five percent range and looks like software. Pessimistic: heavy safety constellation, premium voice, long calls with lots of turns, and the same call costs sixty to eighty cents. That is a gross margin closer to fifty percent and looks like a managed service. Nobody outside the company knows which one is true, and the honest answer is probably that it varies enormously by agent type and has been falling fast as inference costs fall generally.

But raw compute is not the whole COGS, and this is the part that most analyses miss. The safety apparatus is staffed by humans. More than seven thousand five hundred licensed clinicians have participated in validating these agents, and clinicians participating in a structured testing program are being paid to do it. Every new agent goes through a phased rollout modeled on clinical trial design, with the creator and the company’s own clinical staff running adversarial testing before anything touches a real patient. Implementation is not self-serve either. Integrating with an EHR, a scheduling system, a telephony stack, and a care management platform is a professional services engagement, negotiated per deployment, and health systems do not run these deployments without a governance committee that meets monthly and asks for a report.

So the useful mental model is a company with software-like marginal compute costs sitting underneath services-like fixed costs for safety and deployment. Gross margin at any given customer improves dramatically with volume, because the validation cost for the discharge agent is paid once and the call cost is paid per call. That is a real operating leverage story, and it is the correct bull case. It is also why the company pushes so hard on cumulative interaction counts, because those numbers are the evidence that the fixed cost is amortizing.

Funding, valuation, and the revenue gap nobody wants to name

The financing history is fast even by 2024 to 2026 standards. Fifty million in seed money in mid 2023 from General Catalyst and Andreessen Horowitz, before the product existed. Fifty-three million in a Series A in March 2024 at a five hundred million post, which brought in Premji Invest and, more importantly, health systems as direct investors. Seventeen million from NVIDIA’s venture arm along the way. A hundred forty-one million Series B in January 2025 led by Kleiner Perkins at one point six four billion, nine months after the A. Then a hundred twenty-six million Series C announced November 3, 2025, led by Avenir Growth with CapitalG joining alongside the existing syndicate, at three point five billion post, bringing total capital raised to roughly four hundred forty-four million. John Doerr and Rick Klausner are on the cap table personally. Headcount went from roughly a hundred ninety to over three hundred across 2025 and into 2026.

Now the uncomfortable arithmetic. The company does not publish revenue. Third-party trackers that estimate private company financials have put the number in the mid teens of millions of ARR, which against a three point five billion valuation implies a multiple north of two hundred times. For comparison, the ambient scribing category, which is the closest thing to a benchmark, generated roughly six hundred million in total category revenue in 2025 and its leaders trade privately somewhere in the forty to seventy times range.

Two caveats, both real. First, third-party ARR estimates for private companies are frequently wrong by a factor of two or three in either direction, and the usage-based model makes them harder to estimate than seat-based ones because there is no seat count to multiply. Second, the volume numbers do not obviously reconcile with a small revenue figure, and that gap is the single most interesting analytical question about this company. Cumulative patient interactions went from more than a hundred eighty million in April 2026 to more than two hundred fifty million by August 2026, which annualizes to something like a hundred twenty million interactions a year. If every one of those were a ten-minute voice call at list price, that would be twenty million agent hours and a hundred eighty million dollars of gross billings. It is obviously not that, which tells you something important: an interaction is not an agent hour. The interaction count almost certainly includes texts, short touches, individual conversational turns, or multiple contacts per patient episode, and it includes the ten million patient interactions that came in with Grove. The distance between a hundred twenty million interactions a year and a mid-eight-figure revenue number is the distance between a marketing metric and a billing metric, and anyone underwriting this company should build their model on the second one.

What the Series C is really buying is time to find out whether agent hours compound the way seats do. Usage-based revenue in healthcare has a bad habit of plateauing at the pilot’s edge, because the pilot covers one service line and expanding to the next one requires a new champion, a new governance review, and a new integration. Seat-based software expands when the customer hires. Hour-based software expands only when the customer decides to route more work to it, which is a decision, not a default.

How the deals actually get done

The distribution strategy is the smartest thing on the balance sheet and it barely looks like a strategy. Universal Health Services, WellSpan Health, and Cincinnati Children’s are investors in the company. So are several other systems. That is not a rounding error on the cap table, that is a go-to-market channel disguised as a financing round.

Health systems buying from a startup have a canonical problem: the innovation team loves it, the CFO wants to know who else has done this, and the procurement process takes eleven months to establish that the vendor will still exist in three years. Putting the buyer on the cap table collapses that. It converts the reference customer into an economically motivated reference customer, it gives the vendor a design partner who will actually take the calls, and it gives the health system a story to tell its board about being an operator rather than a purchaser. The co-development pattern shows up directly in the product: Nurse Co-Pilot was built with Cincinnati Children’s, OhioHealth, and Cleveland Clinic, and AI Front Door launched with WellSpan and Cincinnati Children’s. Those are not logos on a slide, those are the systems that told the company what the agent needed to do.

The customer list beyond the investors spreads across categories in a way that reveals the sales motion. Provider systems like OhioHealth and HonorHealth. Home and community care like VNS Health. Risk-bearing entities and enablers like Arkos Health, Belong Health, and GuideHealth, which is telling because value-based organizations have the cleanest ROI math on earth for outreach: closing a gap or preventing an admission has a directly calculable dollar value in a capitated arrangement. Dental service organizations like Ideal Dental, which is a reminder that the biggest use case in dollar terms might turn out to be recall and no-show reduction rather than anything clinical. And Fraser Health in Canada, which is the international beachhead in a single-payer system where the labor shortage is worse and the procurement is centralized.

Safety as the moat and safety as the tax

The company’s core marketing claim is a safety record: about 99.90 percent correct clinical advice, zero severe harm events across more than a hundred eighty million patient interactions, validated by more than seven thousand five hundred licensed US clinicians. Whatever else you think about it, that is the right thing to be measuring and the right thing to be publishing, and almost nobody else in patient-facing AI publishes anything comparable.

It is also a claim that deserves the ordinary amount of scrutiny. Correctness rates depend entirely on the denominator and the rubric, both of which are internal. Zero severe harm events depends on what counts as a severe harm event and on who is looking for them, and the honest limitation of any post-market surveillance program is that it finds the harms it is designed to find. None of that means the numbers are wrong. It means they are self-reported, and a serious buyer should be asking to see the taxonomy, the adjudication process, and whether the reviewing clinicians are independent of the company. Early evidence suggests health systems are asking exactly that, because the nurse-in-the-loop testing process is the thing buyers say they can interrogate, which is a polite way of saying it is the thing they interrogate.

The strategic point is that safety is simultaneously the moat and the tax. It is a moat because a general-purpose voice model with a good prompt can do about seventy percent of this and will never be allowed anywhere near a discharged cardiac patient without exactly this kind of apparatus, and building the apparatus takes years and thousands of clinician hours. It is a tax because every new agent, every new indication, every new language, and every new market has to go back through it, which slows expansion in precisely the way that a usage-based model cannot afford. The app store is the attempted answer to that tension: let clinicians build agents themselves in under an hour, run them through a compressed safety gauntlet in three to four hours, publish them to other health systems, and pay the creator a revenue share. If that works it turns the safety tax into a platform. If it does not, it turns into a very long queue.

The regulatory box the model has to stay inside

The non-diagnostic constraint is what keeps the product out of FDA device territory. Software that provides information to a patient rather than a diagnosis or a treatment recommendation, and that does not analyze a signal or image to drive a clinical decision, generally sits outside the device definition or inside the enforcement discretion carve-outs. Cross that line, and the company is running a clinical trial and a submission for every agent, which would destroy the economics instantly. Everything about the product design, including the specialist safety models whose job is partly to detect when a patient conversation is drifting toward a clinical question and hand it off to a human, exists to keep the product on the safe side of that line.

The federal picture is stable. The state picture is not, and it is where the real compliance work has moved. California AB 3030 requires a prominent disclaimer whenever generative AI produces a clinical patient communication, plus clear instructions for reaching a human, unless a licensed clinician substantively reviews the message first. For a real-time voice call, “prominent throughout” is a design constraint, not a footnote. California AB 489, effective at the start of 2026, prohibits AI from using credentials, titles, icons, or design cues implying the patient is talking to a licensed professional, and restricts marketing language like clinician-guided or doctor-level unless licensed oversight genuinely exists, with enforcement by professional licensing boards and each instance counting as a separate violation. Texas TRAIGA took effect January 1, 2026. Illinois banned AI from delivering therapeutic communication outright. Utah has consumer-request disclosure obligations and separate rules for mental health chatbots. Colorado’s comprehensive AI act was repealed and replaced in mid 2026 with a narrower, disclosure-based framework whose core obligations start in 2027, which is a fair summary of how the entire state landscape is behaving: aggressive, then negotiated, then delayed, then narrower.

For a company selling into fifty jurisdictions, this is a per-state configuration problem in the agent’s opening script, a per-state logging and retention obligation, and a per-state answer to what happens when the patient asks the agent something it is not allowed to answer. It is annoying, it costs money, and it is also quietly a moat, because a health system is not going to build this themselves and a generic voice agent vendor is not going to maintain a fifty-state compliance matrix for a healthcare vertical that represents four percent of its revenue.

The app store, the life sciences turn, and the second S curve

Provider budgets are large but slow. Pharma budgets are large and fast, and in January 2026 the company went and got them. It acquired Grove AI, a two-year-old startup out of Stanford Medicine whose voice agent, Grace, handles clinical trial recruitment, pre-screening, and follow-up, and which had powered more than fifty phase two and three trials and over ten million patient interactions in a year, including work for two of the top five global pharma companies. Grove had raised under five million dollars in seed capital. Terms were not disclosed, which usually means small.

Strategically this is the right trade for three reasons. Sponsors pay far more per successfully enrolled patient than a health system pays per outreach call, because a delayed phase three trial costs a sponsor somewhere between half a million and eight million dollars a day in lost exclusivity time, depending on the asset. The buyer moves faster because clinical operations budgets do not go through a hospital capital committee. And a recruitment agent that knows about hundreds of trials at once is structurally better than a human recruiter working one protocol, which is a rare case of AI having a genuine capability advantage rather than just a cost advantage. Alongside the acquisition came a life sciences president, an executive advisory council, and a Boston Consulting Group collaboration, which is the standard package for a company that has decided pharma buys from consultants.

The open question is whether the safety story that sells to a chief nursing officer translates. Life sciences has its own validation vocabulary, and a sponsor operating under GCP will ask about computerized system validation, audit trails, change control, and who is accountable when an agent mis-screens a patient into or out of a study. Those are answerable questions. They are also different questions, requiring a different set of documents, and a company already carrying a heavy safety apparatus is now carrying two.

What breaks it

Four things, roughly in order of how much they should worry an investor.

The first is bundling. Epic has been shipping its own agents, and the pattern in health IT is depressingly consistent: the EHR vendor watches a category prove itself, builds seventy percent of it, includes it in the existing contract, and the standalone vendor’s growth rate falls off a cliff while its churn rate does not. Documentation vendors are living through the early version of this now. A patient outreach agent that lives natively in the chart, requires no integration, and costs nothing incremental does not have to be as good as Hippocratic’s to take half the market. The counter is that Epic’s agents will not carry a hundred eighty million-interaction safety record or a fifty-state compliance posture, and that health systems increasingly want a vendor they can hold accountable rather than a feature they cannot sue. That counter is real but it is not permanent.

The second is margin compression from both directions at once. Underneath, model providers keep making inference cheaper, which is good for COGS but also means the technical barrier drops for everyone else. Above, once a health system has run the agent for two years and knows exactly how many hours it uses, the nine-dollar rate becomes the subject of a renewal negotiation against a vendor that now has a revenue concentration problem. Usage-based pricing gives you fast expansion and painful renewals.

The third is the labor politics, which are not a footnote and are getting louder. National Nurses United represents more than two hundred twenty-five thousand nurses, has published a nurse and patient AI bill of rights, and has been running a Trust Nurses Not AI campaign since 2024. Kaiser call center nurses have been picketing over algorithmic monitoring. A Bronx health system laid off a dozen utilization review nurses this July and the state nurses association immediately called it a contract violation. Union contract language on AI is still rare, appearing in only about seven of a hundred-plus tracked health systems, but that number only goes one direction, and every new contract negotiated from here will have someone at the table asking for a right to override AI output and a prohibition on AI-driven headcount reduction. Notably, nurses are not anti-technology in the surveys: roughly forty-one percent already use AI at work and sixty-one percent expect it to improve care quality within a decade. The objection is about governance and about who captures the savings. Which means the winning posture is exactly the one the Nurse Co-Pilot product implies, AI that returns hours to the nurse rather than removing the nurse, and the company clearly knows it, because that is precisely how the April launch was framed.

The fourth is the one nobody can model, which is a single bad call. Zero severe harm events across a hundred eighty million interactions is an extraordinary record right up until the interaction where it is not, and the first genuinely bad outcome involving a patient-facing voice agent, whoever it happens to, will reset the procurement conversation across the entire category for two years. That is the actual risk in the business, and it is not diversifiable, not insurable in any meaningful sense, and not something a Series C solves.

Put it all together and the picture is a company with a genuinely novel pricing model attacking the largest cost line in healthcare, with the right investors, the right design partners, and a safety apparatus that is both its differentiation and its overhead. Whether it is worth three and a half billion depends almost entirely on one number the company has not published, which is how many billable agent hours a mature customer actually consumes in year three. Everything else is narrative. That number is the business

.

The comparison point is not software. It is people. A fully loaded registered nurse costs $55-65/hr. Agency nurses bill higher. Off…

Read more

The comparison point is not software. It is people. A fully loaded registered nurse costs $55-65/hr. Agency nurses bill higher. Offshore call centers run $15-25/hr. At $9, the procurement math takes four seconds.

That shifts the buyer from a chief information officer on an IT budget to a chief nursing officer with open positions and a chief operating officer with a call abandonment rate. Operating labor budgets are orders of magnitude larger than software budgets.

The company reports 250 million patient interactions. Third-party trackers put revenue in the mid-teens of millions. That gap - between the interaction count and the billing number - is the single most important analytical question about this company right now.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

🎧 Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Stress Testing the New Yale Medicare for All Preprint: Where the 114,174 Lives and $1.041 Trillion Actually Come From, and What All Payer Medicare Rates Would Do to Hospital and Physician Margins

A Yale preprint says Medicare for All saves $1.041 trillion/year and prevents 114,174 deaths. Those numbers are everywhere now. Here is what the model actually does and where the real uncertainty lives…

Listen now

3 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

1. The tweet, the preprint, and the spreadsheet underneath

2. Four line items do basically all the work

3. The rate cut nobody wants to say out loud

4. What 100% of Medicare does to a hospital P&L

5. Physicians, or why a 13% revenue cut is a 30% pay cut

6. The admin savings line and the difference between waste and payroll

7. The fraud line, where the argument eats itself

8. The drug line and the gross-to-net problem

9. The missing add-back: 340 million people stop paying at the counter

10. 114,174 deaths and the elasticity chain holding it up

11. Why the number went from 68,531 to 114,174

12. What the other scorekeepers say and why they disagree

13. The countries in the footnotes and what they actually traded

14. So what, if there’s money on the line

    Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of Contents

• A July 24, 2026 medRxiv preprint from Galvani et al. (Yale SPH + UMB) projects that Medicare for All cuts national health expenditure by $1,041B/yr and prevents 114,174 deaths/yr. Not peer reviewed. Updates the 2020 Lancet paper (68,531 lives, about $450B).

• Method is a static one-year stepwise accounting exercise. Start at $5.2786T (2024 NHE), subtract assumed reductions, report the remainder.

• Four subtractions: drug prices $377.5B, all-payer Medicare rates $295.6B, admin $286.3B, fraud $285.7B. Those sum to about $1,245B against a net of $1,041B, implying roughly $200B of add-back for covering 27.5M uninsured, removing all cost sharing, and adding dental/vision/hearing/LTSS.

• The rate line is the load-bearing wall. KFF estimated that limiting private insurance reimbursement to Medicare rates would reduce spending by about $352B in 2021, so the paper’s $295.6B figure is not obviously out of line, though any such cut is still a large revenue shock to hospitals and physicians.

• Admin savings are real but are also roughly two million people’s jobs. Fraud savings are asserted against a single payer that GAO keeps on its high-risk list. Drug savings are computed against list prices in a market with a large gross-to-net gap.

• Mortality estimate rests on a chain of elasticities from the Massachusetts and Oregon coverage literature, each with wide error bars, applied to a 2026 uninsured baseline inflated by the 2025 coverage retractions.

• Verdict: the arithmetic mostly works. The behavioral and political assumptions are where it lives or dies.

Read more

The method: start with $5.28 trillion in national health expenditure, subtract four big line items, report the remainder. Drug prices (-$377.5B), provide…

Read more

🎧 Part I Podcast free on Spotify.

Thoughts on Healthcare Markets & Technology

Part I:Where the Money Actually Moves After the Reconciliation Law: Medicaid Work Requirements, $50B Rural Fund, Provider Tax Phase-Downs, and What Entrepreneurs and Investors Should Build and Buy Now

The viral tweet about Medicare solvency moving from 2052 to 2040 got 750K engagements. The 2026 Trustees report says 2033. That is one quarter earlier than 2025, not 12 years…

Listen now

4 days ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Part II:Where the Money Actually Moves After the Reconciliation Law: Medicaid Work Requirements, $50B Rural Fund, Provider Tax Phase-Downs, and What Entrepreneurs & Investors Should Build and Buy Now

The viral tweet about Medicare solvency moving from 2052 to 2040 got 750K engagements. The 2026 Trustees report says 2033. That is one quarter earlier than 2025, not 12 years…

Listen now

4 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. The viral tweet was half right, half stale, and entirely useful

2. The actual statute, laid out on a calendar

3. The compliance industrial complex: 80 hours a month, verified

4. The $50B rural fund is a procurement event wearing a policy costume

5. Churn as a permanent condition, and the businesses that eat it

6. Provider balance sheets go from state directed payments to self pay

7. The uninsured person is now a retail customer with a wallet

8. What gets harder, and what should not get funded

9. Underwriting this: pricing, contracting, and the timing problem

10. The window runs to 2033, and here is how it probably closes as

    Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Abstract

• CBO’s Feb 2026 baseline: uninsured up 3.4M in 2026, 7.5M in 2027, 8.7M in 2028, topping 35M by 2028, a third higher than 2025

• Medicaid work requirements (80 hrs/mo, ages 19-64) hit all states by 1/1/27; interim final rule landed 6/1/26, effective 7/31/26; NE live 5/1/26, MT and AR 7/1/26, IA 12/1/26

• $200M in federal grants for state eligibility system builds; half split evenly across 51 recipients, half by share of affected population

• Rural Health Transformation Program: $50B over FY26-30, $10B/yr, avg state award $200M (range $147M NJ to $281M TX), money flows 10/1/26, up to 10% can go to a rural tech catalyst fund

• Provider tax safe harbor drops 6% to 3.5% in expansion states, 0.5 pts/yr starting 10/1/27; SDPs capped at 100% of Medicare (110% non-expansion), grandfathered ones step down 10 pts/yr from 1/1/28

• Enhanced PTCs expired 1/1/26: effectuated enrollment fell from 22.3M in 2025 to 19.2M in Feb 2026, and KFF projects about 17.5M for 2026, with some estimates as low as 16.5M; average subsidized premium payments up 114% ($888 to $1,904), benchmark premiums up 26%, with the largest drop in the 400%-500% FPL band

• Medicare HI trust fund depletes Q2 2033, one quarter earlier than last year’s report, not 2040

• The 4% PAYGO Medicare sequester never happened; the Nov 2025 CR wiped the scorecards

• Digital health VC: $7.4B across 244 deals in H1 2026, up 15% YoY, mega deals took 45% of dollars

• Thesis: the durable opportunities are in eligibility infrastructure, churn absorption, state procurement, self pay economics, and rural asset consolidation, not in coverage nostalgia

The viral tweet was half right, half stale, and entirely useful

Seven hundred fifty thousand engagements on a claim that Medicare solvency got yanked from 2052 to 2040 is a good reminder that the internet grades on vibes, not on actuarial tables. The 2026 Trustees report, published June 9, puts Hospital Insurance depletion in the second quarter of 2033. That is one quarter earlier than the 2025 report projected, and the deterioration traces mostly to the reconciliation law’s changes to the taxation of Social Security benefits, which trimmed HI revenue. One quarter. Not twelve years. At depletion, incoming revenue covers roughly 89 percent of Part A benefits, which translates into an 11 percent haircut on hospital payments growing toward 16 percent by 2040. That is genuinely bad and worth being upset about. It is just not the number in the tweet.

Same story with the 4 percent Medicare sequester that dominated healthcare finance panels through the back half of 2025. The reconciliation law added roughly $3.4 trillion to the deficit, which under statutory PAYGO should have triggered an OMB sequestration order in January 2026, capped at 4 percent for Medicare, worth about $45 billion in FY2026 and something near $490 billion through 2034. Then the continuing resolution that reopened the government on November 12, 2025 quietly wiped the PAYGO scorecards clean at the end of the calendar year, and the cut evaporated. The 2 percent Budget Control Act sequester is still there, humming along since 2013 like a subscription nobody remembers signing up for. Anyone who built a 2026 model around a 6 percent Medicare reduction spent Q4 of last year forecasting a ghost.

None of which means the underlying panic is misplaced. The $66 billion “nine year ban” in the second tweet is real and mostly accurately described: the law froze implementation of the Medicare Savings Program eligibility rule and the Medicaid and CHIP enrollment streamlining rule through September 30, 2034, and CBO scored the resulting non enrollment as savings. Roughly a trillion in gross Medicaid and CHIP reductions over ten years is real. Ten million additional uninsured by 2034 is real. The point for anyone building or writing checks is that the headline numbers circulating on social are a lagging, lossy compression of a statute whose actual mechanics are far more specific, far more dated, and far more addressable. The specifics are where the businesses are.

The actual statute, laid out on a calendar

Treat the law as a schedule of forcing functions rather than a single event, and the investable structure gets obvious fast. Retroactive coverage already shrank as of January 1, 2026, down to one month for expansion adults and two months for everyone else, which quietly moved a chunk of hospital admissions from “we will backfill eligibility later” into “this is self pay unless somebody catches it at registration.” Enhanced premium tax credits expired the same day. CMS issued its interim final rule on community engagement on June 1, 2026, effective July 31, and required state outreach to affected beneficiaries starting somewhere between July and September of this year depending on the approach each state picked. Every state has to be running work requirements by January 1, 2027, with good faith extensions available no later than December 31, 2028.

Then 2027 gets busy. Six month redeterminations replace annual renewals for the expansion adult group. Quarterly checks against the Social Security Death Master File begin, along with cross state duplicate enrollment matching, which is going to be its own comedy once two states discover they have both been paying capitation on the same person for three years. October 1, 2027 starts the provider tax safe harbor phase down in expansion states, 6 percent dropping half a point a year until it hits 3.5 percent in FY2032, with nursing facilities and intermediate care facilities carved out. January 1, 2028 begins the 10 percentage point annual step down for grandfathered state directed payments, headed toward 100 percent of Medicare in expansion states and 110 percent in non expansion states. October 2028 turns on cost sharing of up to $35 per service for expansion adults above the poverty line, with primary care, behavioral health, FQHC, RHC, and CCBHC services exempted.

CBO’s February 2026 baseline, its first real refresh since June 2024, priced all of this out: 3.4 million more uninsured in 2026 versus 2025, 7.5 million more in 2027, 8.7 million more in 2028, with the total uninsured population crossing 35 million by 2028, about a third higher than where it sat in 2025. Between 2025 and 2032, the number of people helped by marketplace credits or expansion coverage falls by 16.5 million, a 44 percent decline. Marketplace enrollment is the fastest moving piece. Effectuated 2026 enrollment looks like it is landing near 17.5 million, possibly as low as 16.5 million, down from 22.3 million in 2025, with an outsized share of the drop coming from the 400 to 500 percent of poverty band that made up only 3 percent of plan selections but 27 percent of the decline. Average subsidized premium payments went from $888 to $1,904, a 114 percent increase, while benchmark premiums rose 26 percent, the biggest jump in eight years, and average deductibles climbed about $1,000 per person.

The compliance industrial complex: 80 hours a month, verified

Here is the least glamorous, most bankable observation in the whole thing. Congress just mandated that fifty state agencies, most of which are running eligibility systems that were modernized during the Obama administration and have been patched by a rotating cast of systems integrators ever since, must verify a monthly behavioral attestation for more than twenty million people, on a deadline, with an interim final rule that arrived seven months before go live. CMS put $200 million on the table for the build, half distributed evenly across the 51 eligible recipients and half weighted by the share of enrollees subject to the requirement. Two hundred million dollars. Split fifty one ways. For a nationwide data integration program touching payroll records, education enrollment, volunteer hours, job training participation, and medical frailty determinations, with a 30 day cure period before anyone can be terminated and an explicit prohibition on delegating enforcement to managed care plans.

That last detail matters enormously and almost nobody outside state Medicaid directors is talking about it. States cannot hand this to the MCOs. The plans have the member contact data, the care management staff, the outreach infrastructure, and the incentive to keep members enrolled, and they are structurally barred from owning the verification. So the state has to do it, the state does not have the staff, and the state’s incumbent eligibility vendor quoted a number with a comma in it that made the budget office laugh. Every one of those gaps is a contract.

The realistic product surface breaks into a few clusters. Data brokerage and ex parte verification is the biggest: whoever can pull payroll data, gig platform earnings, student enrollment, and unemployment insurance wage records and return a clean monthly determination without asking the beneficiary for a document is going to print money, because every avoided manual review is an avoided appeal, an avoided procedural termination, and an avoided lawsuit. Arkansas learned in 2018 that the failure mode is not people refusing to work, it is people not knowing they had to report. Notice and outreach orchestration is the second cluster, and it is more interesting than it sounds given the rule requires notification by mail plus at least one additional channel, which means somebody has to maintain deliverable contact data on a population that moves constantly. Medical frailty and exemption adjudication is the third, and it is the one where clinical data actually matters, because proving an exemption from claims history and problem lists beats making a sick person assemble a paper file. Fourth is appeals and fair hearing workflow, which is going to get absolutely buried starting in the first quarter of 2027.

The live pilots are already running. Nebraska went first on May 1, 2026. Montana and Arkansas launched July 1, with Arkansas holding enforcement until January. Iowa comes online December 1. Those four states are the reference customers for everything that follows, and their vendor selections over the next two quarters are the single most useful public signal available for anyone underwriting this category.

The $50B rural fund is a procurement event wearing a policy costume

CMS announced Rural Health Transformation Program awards on December 29, 2025, and the structure is unusual enough to deserve real attention. Fifty billion dollars across FY2026 through FY2030, ten billion a year, all fifty states approved, first year awards averaging $200 million with a range from $147 million in New Jersey to $281 million in Texas. Half the annual pot splits evenly among approved states regardless of size, which is why the per capita math is completely unhinged: discretionary funding per thousand rural residents ranges from about $26,600 in Michigan to about $662,800 in Alaska. Averaged nationally, the program works out to roughly $144 per rural resident over five years, against independent estimates that federal Medicaid spending in rural areas falls by $137 billion over the same decade. So it is not a replacement. It is a transition subsidy with a spending deadline attached, and money starts flowing October 1, 2026.

CMS also stood up an Office of Rural Health Transformation inside the Center for Medicaid and CHIP Services, which tells you they expect this to require ongoing referee work. States are already in procurement, and the approaches are all over the map: direct gubernatorial allocation in some, third party administrators in others, and in North Dakota, of all things, the Bank of North Dakota running a rural facility infrastructure loan program. Rhode Island handed oversight of health center allocations to its primary care association. Several states are standing up rural technology catalyst funds, which the statute allows up to 10 percent of the award to support, aimed at consumer facing chronic disease prevention and management technology. Alaska’s plan includes unmanned drone delivery, remote pharmacy dispensing units, and portable diagnostics, because when your service area has no roads, the vendor evaluation criteria look different.

For founders, this is a rare moment when a large pot of money is chasing a category rather than the reverse, and the buyers are inexperienced at buying. That cuts both ways. Performance based contracting is being pushed hard by policy shops precisely because states are under pressure to obligate first year dollars fast, which is exactly the condition under which somebody sells a state a $12 million telehealth platform that six critical access hospitals will never log into. The companies that win the durable share here are the ones that can survive the five year cliff, meaning products with a real payer or provider revenue model underneath that use RHTP as customer acquisition subsidy rather than as the business. Hub and spoke specialty models, rural clinically integrated network enablement, shared services for revenue cycle and supply chain across small hospital cohorts, cybersecurity remediation for facilities that have never had a CISO, and interoperability plumbing to connect referral pathways all fit that description. Anything priced as a five year grant funded pilot does not.

Churn as a permanent condition, and the businesses that eat it

The most underappreciated structural change is not the level of coverage, it is the volatility. Six month redeterminations for expansion adults double the number of eligibility events per member year. Monthly work verification adds twelve more decision points. Quarterly Death Master File runs and cross state duplicate checks add periodic mass adjudications. Retroactive coverage shrank, so the safety net under an eligibility error got thinner. Cost sharing arrives in 2028 for a population that has never had a copay. Stack all of that and the expansion adult population stops being a coverage cohort and starts being a flow, with people cycling between Medicaid, marketplace, employer coverage, and uninsured on a cadence measured in months.

Health plans feel this first and worst. Risk pools built on annual enrollment assumptions get a selection problem when the healthy leave on the first missed report and the sick fight through the appeal. Medical loss ratios move in ways actuaries have not had to model since the unwinding, except now it is permanent rather than a one time event. Marketplace plans get the mirror image, absorbing a sicker, older, more subsidy sensitive book after the healthy walked when their premium doubled. Anybody selling risk adjustment accuracy, mid year risk score recapture, or rapid onboarding assessment into that environment is selling into acute pain.

Providers feel it at registration. The single highest ROI product in American healthcare over the next thirty six months might be boring real time coverage discovery, because the failure mode is now systemic rather than incidental. A patient who was Medicaid eligible in March, terminated in May for a missed work report, restored in July on appeal, and shows up in June with chest pain generates a claim that will deny, appeal, and eventually get written off unless something in the front end catches the gap and either restores eligibility, initiates presumptive eligibility, or routes the person into a financial assistance pathway before discharge. Multiply by an uninsured population growing from 19.2 million in February 2026 to roughly 35 million by 2028 under the CBO baseline.

The enabling data infrastructure is the quiet arbitrage. Eligibility status, coverage history, and the ability to reconcile a person across state lines and across payers is exactly the kind of identity resolution and record retrieval problem that has been an unglamorous back office function for twenty years and is about to become a front line clinical and financial control. Volume goes up, stakes go up, latency requirements go up. Pricing power follows.

Provider balance sheets go from state directed payments to self pay

The financing provisions are where the sophisticated money should be paying attention, because they are slower, larger, and far less reversible than the coverage provisions. Nearly every state uses provider taxes to fund the non federal share of Medicaid, and about two thirds use state directed payments to push managed care rates above the fee schedule, historically toward average commercial rates. The law bans new provider taxes, freezes existing ones, tightens uniformity requirements, and in expansion states walks the safe harbor from 6 percent to 3.5 percent between FY2028 and FY2032. Separately, CMS finalized a rule effective April 3, 2026 barring states from taxing Medicaid managed care organizations at higher rates than non Medicaid plans, which closes another door. On the SDP side, new arrangements cap at 100 percent of Medicare in expansion states and 110 percent in non expansion states, and grandfathered preprints step down 10 percentage points per rating period starting January 1, 2028.

Translate that into hospital finance and the picture is stark. A safety net system in an expansion state that has been earning average commercial rates on its Medicaid managed care volume through a grandfathered directed payment program is looking at that spread compressing to Medicare rates over roughly seven years, while the tax mechanism funding the state share shrinks simultaneously, while the uninsured share of its volume climbs. One estimate has hospitals losing $68.6 billion in revenue across 2026 and 2027 alone, with nearly half of that, $33.6 billion, coming out of commercial revenue as people lose marketplace coverage rather than Medicaid. Uncompensated care rises by something like $204 billion over ten years, $63 billion of it landing on hospitals and $24 billion on physicians. Revenue recognition under ASC 606 gets genuinely hairy when the payment rate for a grandfathered program is a declining function of a rating period that has not been approved yet.

The investment implications are not subtle. Distressed and special situations capital should be sharpening pencils on rural and safety net hospital assets, physician groups with heavy Medicaid mix, skilled nursing operators exposed to the pieces of the phase down they thought they were exempt from, and behavioral health providers whose payer mix is structurally Medicaid. Consolidation accelerates, and it will be politically ugly. On the operating side, anything that materially improves cash conversion for a provider losing 5 to 15 percent of net revenue over five years gets bought without a long sales cycle: denials prevention, prior authorization automation, coding accuracy, contract modeling against the new SDP caps, cost accounting good enough to decide which service lines to close. The macro backdrop is not hostile to this. Digital health startups raised $7.4 billion across 244 deals in the first half of 2026, up 15 percent from $6.4 billion in the same period last year across essentially the same deal count, with median deal size up from $12 million to $14 million and mega rounds absorbing 45 percent of all capital. Revenue cycle in particular is drawing enterprise scale capitalization, which means the buyers on the other side of a seed stage exit actually exist.

The uninsured person is now a retail customer with a wallet

Eleven million additional people paying cash for healthcare over a decade is, whatever else it is, a market. This part makes people uncomfortable and it should, but ignoring it does not make the patients better off, and the alternative to a functioning cash market for them is not coverage, it is nothing.

The pieces already exist in fragments. Direct primary care memberships in the $70 to $150 a month range look very different to a 45 year old at 420 percent of poverty whose marketplace premium just went from $400 to $900 with a $7,500 deductible. Cash pay imaging and lab marketplaces have been niche curiosities for a decade and are about to have a moment. Generic and biosimilar direct to consumer pharmacy, transparent surgical bundles at ambulatory surgical centers, and telehealth priced per visit rather than per month all get a demand shock. The GLP-1 category already proved that millions of Americans will pay cash monthly for a healthcare product if the value is legible, which is the single most important consumer behavior datapoint of the decade and is being wildly underused as a template for anything other than weight loss.

What is missing is the connective tissue. Nobody has built a credible financial navigation layer that tells a specific person, given their income, their state, their conditions, and the month, whether they should be pursuing Medicaid restoration, a special enrollment period, hospital charity care, a cash rate, a payment plan, or a manufacturer assistance program, and then actually executes it. That product has to work in all fifty states, has to be accurate on eligibility rules that changed twice this year, and has to be monetizable without charging desperate people. The natural payers are hospitals, who currently spend enormous sums on eligibility vendors and collection agencies for exactly this population and get poor results, and employers, who are watching part time and variable hour workers lose Medicaid and show up asking questions HR cannot answer.

The adjacent opportunity is charity care and presumptive eligibility automation. Nonprofit hospitals have community benefit obligations, financial assistance policies most patients never learn about, and a coming wave of self pay volume. Making that machinery actually function is simultaneously a margin improvement for the hospital, a bad debt reduction, a compliance asset, and the thing that keeps a family out of bankruptcy. Rare alignment. Build it.

What gets harder, and what should not get funded

Symmetry demands the negative list. Anything whose unit economics depend on stable Medicaid expansion enrollment over a multi year member relationship just got structurally worse. Medicaid focused care management companies built around continuous engagement, value based primary care models with attribution logic that assumes members stay attributed, complex care and high utilizer programs with twelve to eighteen month payback periods, and social determinants platforms funded through managed care in lieu of services dollars are all exposed to the same failure mode: the member churns out before the intervention pays back. That does not make the models wrong. It makes their contracts wrong, and contracts are fixable if the founder is honest about it early.

Long term services and supports faces its own squeeze, with the home and community based services waiver pathway not arriving until 2028 while nursing facility economics tighten and the staffing rule moratorium removes a cost that was also, arguably, a quality floor. Anything that assumed the ACA marketplace grows forever needs a haircut: insurtech distribution, enhanced direct enrollment plays, and broker technology all just watched their addressable population shrink by roughly three million effectuated enrollees in 2026, with KFF projecting about 17.5 million effectual enrollees for the year and some estimates as low as 16.5 million.

The category most likely to attract dumb money is work requirement compliance itself. Yes, it is a real spend. It is also a $200 million federal appropriation split across 51 recipients, procured through state contracting processes that favor incumbents with existing master service agreements, on a timeline that rewards whoever can deploy in six months rather than whoever built the better product. Some of that spend becomes durable eligibility infrastructure. A meaningful share becomes a 2027 pilot that gets cancelled in 2029 when a new administration or a court changes the rules. Underwrite accordingly, which mostly means preferring companies whose product still has a buyer if work requirements go away.

Underwriting this: pricing, contracting, and the timing problem

Three practical filters separate the real opportunities from the policy tourism. First, does the customer have money in a specific fiscal year, from a specific line item, with a specific person who signs. State Medicaid agencies, RHTP administrators, hospital CFOs facing SDP compression, and health plans facing MLR volatility all qualify. “The healthcare system” does not. Second, does the product survive a reversal. Political durability here is genuinely uncertain: the enhanced subsidies could come back, work requirements are already drawing litigation, and 2028 is an election. A company selling verification workflow is fragile; a company selling identity resolution and coverage discovery that happens to power verification workflow is not. Third, is the sale a budget reallocation or a new budget request. In a year when hospitals are cutting, the products that get bought are the ones that come out of an existing spend line, which is why revenue cycle keeps winning and why anything requiring net new operating dollars is a two year sales cycle minimum.

On contracting, the shift toward performance based structures in state procurement is real and mostly good, but founders should read those terms very carefully, because a state agency’s definition of a measurable outcome tends to arrive after the contract is signed and tends to be measured on data the vendor does not control. Milestone based payment tied to deployment and volume is survivable. Outcome based payment tied to enrollment retention in a program explicitly designed to reduce enrollment is a trap.

On exits, the picture is better than the sentiment suggests. Consolidated dollars, 45 percent of capital going to mega rounds, and a narrow IPO window with a watchlist that includes several genuine scale businesses all point toward strategic and sponsor M&A as the base case rather than the disappointment case. Health systems and plans are buying capability under duress, which is the best possible condition to sell into if the product is real, and payers with compressed margins are more willing to buy than to build for the first time in about four years.

The window runs to 2033, and here is how it probably closes

Zoom all the way out. Medicare expenditures totaled roughly $1.21 trillion last year across 62.2 million aged beneficiaries and 7.1 million disabled, with 51 percent now enrolled in Part C. The program runs from 3.9 percent of GDP in 2025 to 6.5 percent by 2050 under current law. The HI trust fund hits partial depletion in the second quarter of 2033. Nothing in this statute changes that trajectory, and Parts B and D, which cannot go insolvent because general revenue backfills them, are the faster growing and larger problem that gets a fraction of the attention because they lack a scary date.

Which means the reconciliation law is not the endgame, it is the first move. A program running toward a hard fiscal constraint seven years out, with an aging population, a demonstrated legislative willingness to reduce eligibility rather than reduce prices, and a states side that just lost its favorite financing mechanisms, is going to produce more legislation, not less. The bet worth making is that the next round targets Medicare spending directly, most likely through site neutral payment, Medicare Advantage risk adjustment and benchmark reform, and further drug pricing action, because those are the places with hundreds of billions of scoreable dollars and constituencies too diffuse to stop it.

That framing changes what looks attractive today. Businesses positioned around eligibility infrastructure, churn absorption, cash conversion for stressed providers, state level procurement, and self pay economics are aligned with a decade long direction of travel rather than a single bill. Businesses that require the coverage expansion of 2021 through 2025 to persist are fighting the tape. The unpleasant truth underneath all of it is that the country just decided, through the ordinary operation of its budget process, to trade roughly ten million people’s coverage for a set of tax provisions, and the healthcare economy will reorganize around that decision whether or not anybody in it approves. Entrepreneurs who see clearly and build the connective tissue that keeps people from falling through will do well and will also be doing something worth doing. Everyone else can keep quote tweeting the wrong trust fund date

.

The 4% Medicare sequester everyone modeled in late 2025 also vanished. The Nov CR wiped the pay-as-you-go scorecards. Anyone forecasting a 6% Medicare cut spent Q4 building a ghost…

Read more

The 4% Medicare sequester everyone modeled in late 2025 also vanished. The Nov CR wiped the pay-as-you-go scorecards. Anyone forecasting a 6% Medicare cut spent Q4 building a ghost model.

What is real: 35 million uninsured by 2028 per the CBO baseline, up a third from 2025. Marketplace enrollment down from 22.3M to roughly 17.5M. Average subsidized premiums up 114%.

The $50B Rural Health Transformation Program starts paying out Oct 1, 2026. All 50 states approved. States are already in procurement. Buyers are inexperienced. That window is open now.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

🎧 Podcast episode for paid subscribers only. Also available on Spotify.

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. What FDB actually is, and why Hearst owns it

2. The product is not the data, it is the maintenance

3. How the money works: OEM, modules, and the renewal ratchet

4. The switching cost math nobody writes down

5. Where the public data actually lives

6. The competitive set, and the antitrust accident that created it

7. What AI actually changes, and what it does not

8. Four attack surfaces that are real

9. The liability problem, which is the whole ballgame

10. What a credible challenger looks like in practice

11. Scorecard: who wins, who gets bought, who burns five years

Abstract

• FDB (First Databank) is a Hearst-owned company that sells the machine-readable medication knowledge layer embedded in US EHRs, pharmacy systems, PBMs, e-prescribing, and claims adjudication. MedKnowledge is the flagship. Prizm is the newer platform.

• The raw inputs are mostly free. FDA structured product labeling, the NDC directory, NADAC, ASP, FUL, and NLM’s RxNorm all cost zero dollars. The product is normalization, curation, proprietary identifiers, clinical rules, and daily maintenance.

• The real moat is identifier lock-in. GCN_SEQNO, HICL_SEQNO, and MEDID at FDB, GPI and DDID at Medi-Span. Formularies, order sets, allergy records, interaction overrides, and analytics get keyed to those codes and then never move.

• Regulation creates a demand floor. ONC certification requires drug-drug and drug-allergy checking. OBRA ‘90 forced prospective DUR in pharmacy. Nobody is opting out.

• Duopoly by accident. DOJ forced Hearst to divest Medi-Span in 2001 after its 1998 acquisition, with a roughly $19 million disgorgement, which is why the second player exists at all.

• AI collapses curation cost by one to two orders of magnitude but does not touch liability, distribution, or identifier gravity.

• Four viable attacks: the crosswalk liberation layer, the tuning layer sold on top of incumbents, greenfield licensing to AI-native buyers priced out of enterprise OEM deals, and vertical content nobody bothered to encode.

• Constraint that decides everything: FDA’s 2022 CDS guidance requires an independently reviewable basis. Black box output fails. Citation-grounded output passes. Build accordingly.

  Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

What FDB actually is, and why Hearst owns it

First Databank is a roughly fifty-year-old company out of the Bay Area that sells the medication knowledge layer nobody sees and everybody uses. When a physician types a drug name into Epic and gets an interaction warning, when a pharmacy system flags a duplicate therapy, when a PBM adjudication engine classifies an NDC into a therapeutic class to apply a step edit, there is a decent chance the logic underneath came from a licensed FDB dataset. The flagship is MedKnowledge, formerly known as National Drug Data File Plus, and FDB has been shipping a newer knowledge platform under the Prizm name for a while now. The company also sells patient-friendly medication instructions, an e-prescribing service aimed at specialty medications, and a set of pricing and reimbursement files that state Medicaid programs and PBMs use to decide what things cost.

The ownership is the fun part. Hearst owns it, and has since around 1980. Yes, that Hearst. The magazine company. The one that publishes Cosmopolitan and owns a chunk of ESPN also quietly owns a piece of infrastructure that touches nearly every prescription written in the United States. Hearst Health is a real operating group, not a hobby, and over the years it has included care guidelines, order sets, and home health software alongside FDB. This is the sort of thing that makes newcomers to healthcare data assume the industry is a prank. It is not a prank. It is just what happens when a family-controlled media conglomerate makes one extremely good acquisition in 1980 and then does absolutely nothing to jeopardize it for four decades.

Nobody outside the building knows FDB’s revenue, because Hearst is private and does not break it out. Directionally, the customer footprint suggests a business in the low hundreds of millions with very high gross margin and renewal rates that would make a SaaS board weep with joy. The point is not the size. The point is the shape. This is reference-data economics, closer to a Bloomberg terminal or a bond pricing service than to a healthcare software company, and it has all the pleasant characteristics that implies.

Read more

When your doctor gets a drug interaction warning in Epic, there is a good chance First Databank’s content is powering it. Same for pharmacy duplicate t…

Read more

🎧 Part I Podcast free on Spotify.

Thoughts on Healthcare Markets & Technology

Part I: What Federal Billing Transparency Rules Actually Require, What Patients Can Really Do Before a Bill Hits Collections & Where the No Surprises Act & Price Transparency Rules Have Quietly Failed

The viral HIPAA billing claim is wrong. Hospitals do not need your signed authorization before sending a bill to collections. The Privacy Rule explicitly lists collection as a permitted payment activity…

Listen now

6 days ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Part II: What Federal Billing Transparency Rules Require, What Patients Can Really Do Before a Bill Hits Collections & Where the No Surprises Act & Price Transparency Rules Have Quietly Failed

The viral HIPAA billing claim is wrong. Hospitals do not need your signed authorization before sending a bill to collections. The Privacy Rule explicitly lists collection as a permitted payment activity…

Listen now

6 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

1. Why the chargemaster produces a thousand dollar doxycycline pill

2. What HIPAA actually says about sending a bill to collections

3. The rule with real teeth that almost nobody cites

4. Price transparency after the 2026 rewrite

5. The No Surprises Act worked for patients and broke for everybody else

6. The good faith estimate gap and the advanced EOB that never showed up

7. The credit reporting rule that died and the state laws that may die next

8. Cash pay arbitrage and what the subsidy cliff did to the self pay population

9. What is actually investable in all of this

   Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of Contents

• Viral billing posts are usually right about the outrage and wrong about the mechanism. The legal protections people cite (HIPAA consent before collections) mostly do not exist, and the ones that do exist (Section 501(r) reasonable efforts, amounts generally billed, FDCPA validation, state notice periods) almost never get cited.

• Hospital price transparency was materially rewritten in the CY 2026 OPPS final rule: the estimated allowed amount placeholder is gone, hospitals must now encode actual dollar amounts derived from 12 to 15 months of claims history, a named senior executive must attest the file is true, accurate and complete, and CMS began enforcing on April 1, 2026. CMS declined to shield that attestation from False Claims Act theories.

• The No Surprises Act is a genuine consumer win and a spectacular administrative failure. Roughly 2.6 million disputes were initiated in 2025, providers collected close to $15 billion through IDR versus about $4.1 billion in 2024, the top ten initiating parties drove roughly 70 percent of volume, and about 42 percent of disputes got challenged as ineligible.

• The advanced explanation of benefits for insured patients still does not exist. The good faith estimate only protects self pay patients, and the dispute path only opens at a $400 variance.

• The CFPB medical debt rule was vacated in July 2025 in the Eastern District of Texas, on a joint request from the plaintiffs and the Bureau itself. The same opinion held that FCRA preempts state medical debt reporting bans, which puts roughly 15 state statutes on shaky ground.

• Enhanced premium tax credits expired December 31, 2025. Marketplace enrollment fell to about 23 million from 24.2 million, average net premiums rose 58 percent, and a lot of people just left. The self pay population is growing, and cash prices are frequently below negotiated commercial rates.

• Investable surface area: transparency data normalization, denial and appeal automation, cash pay routing, and 501(r) eligibility screening. The moat is data quality, not data access.

Why the chargemaster produces a thousand dollar doxycycline pill

Start with the viral one, because it is a perfect teaching case. Guy is far from a VA, gets a tick bite, goes to a hospital, walks out with a bill he describes as a thousand dollars for one doxycycline pill and a glass of water. Everyone in the replies concludes the hospital marked up a generic antibiotic by roughly four thousand percent, which is a reasonable read and also not what happened. What almost certainly happened is that the emergency department billed a facility fee, probably a level three or level four visit under the 99283 or 99284 evaluation and management codes, and that facility fee lives in revenue codes in the 045x range with a gross charge that routinely lands anywhere from eight hundred to two thousand dollars depending on the hospital. The physician bills separately under a professional fee, often through a staffing group the patient has never heard of. The doxycycline itself shows up on a 025x pharmacy line at maybe thirty to eighty dollars against an acquisition cost of well under a dollar. The pill is a rounding error. The room was the product.

The reason the gross charge exists at all is a fossil from cost based reimbursement, when hospitals got paid a percentage of charges and the charge master was the actual price list. Prospective payment killed that for Medicare in 1983 and commercial contracts moved to case rates and fee schedules over the following two decades, but the charge master never went away, because charges still drive money in four places that matter. Medicare outlier payments are computed by running billed charges through a facility specific cost to charge ratio, so inflating charges pulls more cases over the fixed loss threshold until CMS reconciles the ratio, which happens on a lag. Percent of charge contracts survive in workers compensation, auto medical payments, some out of state Medicaid, and a nontrivial share of smaller commercial plans. Out of network billing keys off charges. And 340B spread economics are computed against charge based benchmarks in some contract structures. The national average charge to cost ratio sits somewhere around four to one, with a long right tail of investor owned facilities running eight to one and up. Nobody sat in a room and decided doxycycline should cost a thousand dollars. A dozen unrelated reimbursement mechanics each rewarded charge inflation a little, for forty years, and this is the sediment.

One more thing about the tick bite specifically, since the veteran angle got lost in the replies. Emergency care at a non VA facility for an enrolled veteran can be covered under the community care rules, but unauthorized emergency treatment claims run through a separate statutory pathway with a filing window that closes fast, in some cases ninety days from the date of care. Missing that window is not a billing error, it is a jurisdictional problem, and it is one of the more common ways a veteran ends up personally holding a bill that a federal program would have paid two weeks earlier.

What HIPAA actually says about sending a bill to collections

The claim circulating right now is that a provider needs signed HIPAA authorization before it can send an account to a collection agency, and that absent that signature the placement is a privacy violation the patient can leverage into a write off. This is wrong in the way that a lot of confidently repeated legal advice is wrong, which is that it takes something real and files off the qualifiers until it becomes useful and false.

The Privacy Rule permits covered entities to use and disclose protected health information for treatment, payment, and health care operations without authorization. The definition of payment in the regulation explicitly includes collection activities. So a hospital placing a delinquent balance with an agency is doing something the rule contemplates by name. The agency becomes a business associate, needs an agreement, and inherits the same obligations. No signature required, no leverage there.

Where the kernel of truth lives is the minimum necessary standard. A collector working a medical account needs identifying information, dates of service, and the amount owed. It does not need diagnosis codes, procedure detail, medication names, or clinical notes, and there are plenty of real cases where the placement file carried far more than that, or where a dunning letter listed a procedure description that told a mail carrier something about a patient’s body. That is an actual violation, it is enforced by the Office for Civil Rights rather than by private lawsuit, and it is worth complaining about. There is also a genuinely underused right in the same part of the regulation: a patient who pays in full out of pocket for a service can require the provider not to disclose that encounter to their health plan. For anyone doing cash pay for anything sensitive, that restriction is mandatory on request, not discretionary, and almost nobody asks for it.

The protections that do the actual work are elsewhere and are boring. Third party collectors are covered by the Fair Debt Collection Practices Act, which the hospital itself generally is not, and Regulation F requires a validation notice with an itemization date and a set of specific disclosures, caps call frequency, and gives a thirty day window in which a written dispute forces verification before collection resumes. Several states layer on top of that. Texas requires an itemized bill in plain language before an account can be placed at all, and separately requires providers to bill within eleven months of service. A number of states have added notice periods running sixty days or more before collection activity can begin. None of this is as satisfying as a magic HIPAA sentence, and all of it works better.

The rule with real teeth that almost nobody cites

If a nonprofit hospital sends someone to collections, the single most useful thing that patient can know is Section 501(r) of the Internal Revenue Code, and it is remarkable how rarely it appears in the discourse given that roughly sixty percent of community hospitals are nonprofits.

The structure is straightforward. A tax exempt hospital must maintain a written financial assistance policy and publicize it. It cannot charge anyone eligible under that policy more than amounts generally billed for emergency or medically necessary care, which in practice means something close to what commercial insurers and Medicare actually pay rather than the gross charge, computed either by a look back method or prospectively. And before taking what the regulation calls extraordinary collection actions, the hospital must make reasonable efforts to determine whether the patient is eligible for assistance. Extraordinary collection actions is a defined term that covers reporting to credit bureaus, selling the debt, filing suit, garnishing wages, placing a lien, and denying or deferring care because of an unpaid prior bill.

The timing is the part worth memorizing. The notification period runs 120 days from the first post discharge billing statement, during which no extraordinary collection action is permitted. The application period runs 240 days from that same statement, during which the hospital must accept and process a financial assistance application, and if someone applies on day 239 after already being sued, the hospital has to unwind what it can, including reversing credit reporting and refunding overpayments above the amounts generally billed figure. A patient who knows the phrase reasonable efforts and the number 240 has more practical leverage than a patient who knows the entire Privacy Rule.

The catch is enforcement, which is close to theoretical. The excise tax for community health needs assessment failures is fifty thousand dollars per facility, which is not a deterrent for a system doing four billion in net patient revenue, and revocation of exempt status has happened approximately never. The Providence episode remains the cleanest illustration of what weak enforcement produces: internal collection scripting that pushed staff to seek payment from patients who qualified for free care, followed by a state attorney general action and a settlement north of $150 million in refunds and forgiveness. That outcome came from a state consumer protection statute and a newspaper, not from the IRS. North Carolina got roughly $6.5 billion in debt cleared for about two million residents by attaching conditions to enhanced hospital directed payments, which is to say by paying for it. Neither of those is a federal enforcement mechanism. They are workarounds for the absence of one.

Price transparency after the 2026 rewrite

The hospital price transparency rule has been in effect since January 2021 and for most of that time the honest assessment was that hospitals had learned to comply with the letter while producing files that were useless for comparison. Everyone in the data business knows the specific dodges: posting an estimated allowed amount instead of a negotiated dollar figure, burying rates in free text fields, using payer and plan naming conventions that match nothing, omitting the algorithm behind percentage based arrangements, and publishing files large enough to be technically available and practically unparseable. Compliance statistics diverged wildly depending on methodology, with vendor analyses reporting posting rates in the high eighties and above while advocacy groups measuring completeness reported full compliance in the twenties.

Executive Order 14221 in February 2025 told the agencies to require disclosure of actual prices rather than estimates, to standardize the output, and to update enforcement. The CY 2026 OPPS final rule, published November 21, 2025, delivered the substance. The estimated allowed amount placeholder is eliminated. Hospitals must now encode allowed amounts data elements derived from 12 to 15 months of actual claims history, along with a count of the underlying claims, which means percentage based and algorithm based arrangements finally resolve into dollars a person can compare. The file must name the chief executive, president, or other senior official responsible for oversight of the data, and that individual must attest the information is true, accurate, and complete. The requirements took effect January 1, 2026, with enforcement beginning April 1, 2026.

The attestation is the interesting part and the reason general counsel offices have been unhappy. Commenters asked CMS to explain why a defective attestation could not support a False Claims Act theory, or to coordinate with the Department of Justice on a policy of dismissing such cases. CMS declined both, restating that the False Claims Act is outside the scope of the rulemaking. That is not a denial. A named executive signing a completeness attestation on a data file that a relator can independently download and analyze is a fairly novel exposure surface, and the first qui tam built on a demonstrably incomplete machine readable file is going to be an event. CMS has since issued a request for information in the CY 2027 proposed rule seeking comment on further standardization, free text field cleanup, and the consumer facing display, so the ratchet is still turning.

Whether any of this changes prices is a separate question. Transparency assumes a shoppable moment, and the guy with the tick bite did not have one. It matters most for employers, benefits advisors, and the small set of genuinely elective services where a patient has weeks to decide.

The No Surprises Act worked for patients and broke for everybody else

Give the law its due. Balance billing for emergency services, for out of network clinicians at in network facilities, and for air ambulance transport is substantially gone, and the anesthesiologist ambush that generated a decade of local news segments has mostly stopped generating them. Patients are held to in network cost sharing and the fight moves behind them. That is the design working.

Behind them, the fight has been carnage. Congressional Budget Office era projections contemplated something on the order of seventeen thousand disputes a year through independent dispute resolution. In the first half of 2025 alone, providers and payers initiated close to 1.2 million. In the back half, close to 1.4 million. Certified entities closed roughly 1.35 million in the first half and about 1.45 million in the second, which finally outpaced initiations and cleared most of a backlog that stood around 430,000 cases in June 2025. Speed improved too, with about 62 percent of payment determinations rendered inside thirty business days in the second half of 2025 versus 37 percent in the first half.

The economics tell the real story. Providers collected close to $15 billion through the process across 2025, up from roughly $4.1 billion in 2024. In the fourth quarter of 2025, payment determinations were made in 532,548 disputes, and in 462,973 of them the determination came in above the qualifying payment amount the plan had proposed. Read that ratio again. Baseball style arbitration with a batting average like that is not a neutral mechanism, it is an arbitrage, and the volume distribution confirms it: the top ten initiating parties accounted for roughly 70 percent of disputes in the first half of 2025, most of them private equity backed staffing and specialty groups with the operational infrastructure to file at industrial scale. Meanwhile about 42 percent of disputes were challenged as ineligible in the back half of the year, which means a huge share of the administrative burden is spent adjudicating whether the fight is even in the right building.

The most recent final rule lowers the administrative fee from $115 to $15 per case, well below the $150 floated in the proposal, on the theory that access for smaller providers matters more than volume suppression. That is a defensible policy call and also a fairly bold one given that volume suppression is the entire unsolved problem. Plans are already modeling premium impact. The consumer protection is intact and paid for, and the bill is arriving through the premium rather than through the mailbox.

The good faith estimate gap and the advanced EOB that never showed up

Here is the part of the No Surprises Act that nobody talks about because it never happened. The statute contemplated an advanced explanation of benefits for insured patients: before scheduled care, the plan would tell the member what the service is expected to cost them, based on provider submitted estimates. That is the provision that would have made price transparency personal, and it has been sitting in enforcement discretion since the beginning, waiting on rulemaking and on an interoperability standard for passing estimates from provider to plan that the industry has not agreed on. It is the single largest unshipped feature in the entire package.

What did ship is the good faith estimate, and it only applies to uninsured and self pay patients. A provider must give a written estimate of expected charges for scheduled services, and if the final bill exceeds that estimate by four hundred dollars or more, the patient can initiate patient provider dispute resolution for a twenty five dollar administrative fee. The requirement that a convening provider gather and include estimates from co providers, which is the part that would have made the estimate resemble the actual episode rather than one line item of it, has also been under enforcement discretion. So the self pay patient gets an estimate covering the surgeon and not the anesthesiologist, the facility, the pathologist, or the implant.

For anyone building in this space, note what that combination produces. The insured patient, who has the most complex cost exposure because of deductible position, accumulator design, and network tiering, gets nothing. The self pay patient gets a partial estimate and a dispute right that only triggers above a fixed dollar threshold that has never been indexed. And the four hundred dollar threshold is high enough that ordinary outpatient variance sails under it. This is why the market keeps trying to build advanced explanation of benefits functionality privately, why real time benefits check vendors keep pitching it, and why it keeps failing on the same rock, which is that nobody can reliably predict deductible position at the moment of scheduling because claims are still in flight.

The credit reporting rule that died and the state laws that may die next

In January 2025 the Consumer Financial Protection Bureau finalized a rule removing medical debt from consumer credit reports and barring lenders from considering it, which the Bureau estimated would strip about $49 billion in reported debt from the files of roughly 15 million people. It never took effect. On July 11, 2025, the Eastern District of Texas vacated it in Cornerstone Credit Union League v. CFPB, holding it exceeded the Bureau’s authority and conflicted with the Fair Credit Reporting Act, and the striking procedural detail is that the Bureau joined the plaintiffs in asking for that result. Regulatory self defenestration is not common.

What survives is a patchwork. The three bureaus made voluntary changes in 2022 and 2023 that removed paid medical collections regardless of amount, excluded unpaid medical collections under five hundred dollars, and imposed a one year waiting period before new medical collections can be reported at all. Those policies are still in place and by the Bureau’s own estimate they already removed something like seventy percent of medical tradelines. VantageScore 4.0 excludes medical collections outright and FICO 9 weights them down, so much of the score impact was already neutralized before the rule was written. About fifteen states have enacted their own bans.

Which brings up the part that should worry anyone running revenue cycle across state lines. The same Texas opinion held that FCRA expressly preempts state laws regulating what appears on consumer reports. If that reasoning holds and travels, the Colorado, New York, California, Delaware and Virginia style statutes are all sitting on a fault line, and a provider organization that reconfigured its collection policies state by state may find the ground moving in both directions. Nobody should be building compliance architecture on the assumption that this is settled.

The underlying numbers have not moved much regardless of what the rules say. KFF’s analysis of federal survey data puts roughly 23 million adults holding medical debt above the two hundred fifty dollar threshold and at least $220 billion in total, with about 14 million owing more than a thousand and roughly 3 million owing more than ten thousand. Broader definitions that capture medical bills moved onto credit cards, installment plans with providers, and money borrowed from family push the affected population toward a hundred million. And the tell on face value is the secondary market. Charities buying medical receivables have historically paid around a penny on the dollar. A market that clears at one percent of face is telling you exactly what the number on the statement means.

Cash pay arbitrage and what the subsidy cliff did to the self pay population

The third viral post in the set is the one worth the most attention from anyone building a company. A woman priced out of the individual market, quoted twenty one hundred a month with an eighteen thousand dollar deductible, decides to self insure, and then discovers that a cash pay ultrasound runs sixty dollars and a cash pay CT runs three hundred twenty eight. Her point is not that she found a hack. Her point is that the insured version of the same two scans, at a hospital outpatient department, would have generated a facility fee, a professional fee, and a follow up bill somewhere between two hundred and five hundred dollars, all of it applied against a deductible she was never going to meet.

The math is real and it is a site of service story before it is an insurance story. A freestanding imaging center running high volume on owned equipment has a marginal cost per study in the low double digits and prices cash accordingly. The identical study at a hospital outpatient department carries the facility overhead allocation, which is why site neutral payment reform keeps showing up in Medicare Payment Advisory Commission recommendations and keeps dying in committee. And the transparency files have made something visible that used to be folklore: for a meaningful share of shoppable services, the posted cash price is below the negotiated commercial rate. An insured patient in deductible is frequently paying more than the uninsured patient standing next to them, which is a sentence that should not be true and is.

Context matters here, and the context got worse. Enhanced premium tax credits expired December 31, 2025. Marketplace enrollment for 2026 came in around 23 million, down from 24.2 million, and average monthly premium payments net of credits rose 58 percent, from roughly $113 to $178. A lot of that increase was absorbed by people buying down into bronze plans with higher deductibles, and the people facing the steepest increases, those who lost credit eligibility entirely above 400 percent of the federal poverty level, left the market at disproportionate rates. A handful of states put money in, with New Mexico fully replacing the expired subsidies and Connecticut committing seventy million, and a few others used premium alignment tactics to redirect what federal subsidy remains. None of that scales.

So the self pay population is growing, it is skewing toward people who used to be insured and therefore have expectations about care access, and it is arriving with a smartphone and a price comparison habit. That is a different customer than the traditionally uninsured. Buying down into a bronze plan and functionally self funding everything below the deductible produces the same behavior. Both cohorts are shopping.

What is actually investable in all of this

The tempting read is that transparency data is now a commodity because the files are public and the 2026 rule standardizes them. That read is wrong for at least a few more years, because standardization of a schema is not standardization of semantics. Hospitals will encode allowed amounts data elements from claims history using different claim populations, different treatment of denied and partially paid claims, different handling of bundled services, and payer and plan naming that still resolves to nothing consistent across systems. Somebody has to build and maintain the crosswalk between what a file says and what a specific member under a specific plan would actually be charged. That is entity resolution work, it decays continuously, and it is a real moat. The executive attestation requirement also creates a new commercial category on the hospital side, which is data assurance before a named person signs, because that signature now carries exposure a compliance officer will pay to reduce.

The second area is denial and appeal automation, which is the largest under exploited surface in patient facing health tech. Marketplace issuers deny something like a fifth of in network claims and consumers appeal well under one percent of them. That is not a preference, it is a friction problem, and friction problems are what software is for. The interesting versions are not chatbots that write appeal letters. They are systems that parse the explanation of benefits, identify the denial reason code, retrieve the plan’s own medical policy document, and construct an appeal that cites the plan against itself, with the escalation path to external review already loaded. The same engine points at 501(r) eligibility screening, where the addressable population is enormous and the qualifying criteria are published by every nonprofit hospital in the country and read by almost nobody.

The third is cash pay routing, which is where the sixty dollar ultrasound lives. Marketplaces for cash priced services have existed for a decade and have generally struggled on supply density and trust. The subsidy cliff just changed the demand curve, the transparency files just made the supply side legible, and the mandatory right to restrict disclosure to a health plan when a patient pays in full gives the model a privacy story it did not have before. That combination is new.

What is not investable is anything that depends on federal enforcement escalating on a predictable schedule. The credit reporting rule died by joint motion. The advanced explanation of benefits has been pending since 2021. The independent dispute resolution fee just got cut to fifteen dollars in the middle of a volume crisis. Section 501(r) has been law since 2010 with an enforcement record that fits on an index card. Build for the rules that are already in force and already ignored, because that is where the gap between what patients are owed and what patients receive is widest, and gaps like that are the only durable thing in this market

.

The protection that actually works is Section 501(r) of the tax code. Nonprofit hospitals must make reasonable efforts before any extraordinary collecti…

Read more

The protection that actually works is Section 501(r) of the tax code. Nonprofit hospitals must make reasonable efforts before any extraordinary collection action. That window runs 240 days from the first billing statement.

The 2026 price transparency rewrite eliminated the estimated allowed amount placeholder. Now a named senior executive must attest the file is true, accurate, and complete. CMS declined to rule out False Claims Act exposure on defective attestations.

The No Surprises Act protected patients from balance billing and created a 15-billion-dollar arbitrage. The top 10 initiating parties drove roughly 70 percent of independent dispute resolution volume in the first half of 2025.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

🎧 Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

The Underinsured Math Problem: How $26,993 Family Premiums, $1,886 Deductibles, a $21,200 Legal Cost-Sharing Cap and a 42% Patient Collection Rate Add Up to Insurance That No Longer Insures

A family paying $26,993 for health coverage in 2025 has a legal worst-case annual out-of-pocket exposure of $21,200. Worker premium contribution plus that cap: $28,050. That is more than the entire premium. The plan costs less than the maximum the plan lets them owe…

Listen now

7 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Table of Contents

1. A $340 checkup is not a billing error, it is the product

2. Running the actuarial gap on what a family actually buys for $26,993

3. Why the one in four underinsured number is already stale

4. The subsidy cliff moved the pain from premiums to deductibles

5. Employers ran out of levers and nobody told the employees

6. The cash pay arbitrage and the trap hiding inside it

7. Providers are the involuntary lender of last resort

8. Where the businesses actually get built

9. The part nobody wants to underwrite

Abstract

Average family premiums for employer coverage hit $26,993 in 2025, up 6%, with workers kicking in $6,850 of that. The average single deductible sat at $1,886, and 72% of covered workers faced an out-of-pocket maximum above $3,000. Meanwhile the ACA cost-sharing ceiling for 2026 jumped 15.2% to $10,600 single and $21,200 family, which means a worker’s maximum annual exposure now exceeds the entire annual premium of the plan protecting them. Roughly 23% of insured working-age adults already met the standard research definition of underinsured before the enhanced marketplace subsidies expired on January 1, 2026, and two-thirds of those people had employer coverage, not exchange plans. Post-expiration, marketplace enrollment fell from 22.1 million to 19.2 million, average net premium payments rose 114%, and the average marketplace deductible jumped from $2,759 to $3,786 as buyers fled silver for bronze. On the provider side, patient responsibility rose to 7.3% of net revenue while collection on that responsibility fell to 42.4%. This essay works the actuarial gap arithmetic, explains why the cost-sharing ceiling is indexed to the exact thing it is supposed to protect against, and maps where the resulting businesses get built.

Read more

The $340 pediatric checkup that goes viral every few weeks is not fraud and it is not a bad plan. It is a high-deductible benefit design working exactly as priced. If the deductible is not met, the insurer pays zero. A hospital-affiliated visit with a facility fee lands right there.

The consumer protection ceiling on out-of-pocket costs is indexed to private insurance premium growth. Not wages. Not CPI. Premiums. So the cap protecting people from rising costs rises at the pace of rising costs. Wages grew 4% last year. The cap grew 15.2%.

Two-thirds of underinsured Americans are in employer plans. Standard W-2 benefits-eligible coverage. This is not a marketplace or gig economy problem. The Commonwealth Fund put the underinsured share at 23% before enhanced subsidies expired January 1, 2026.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.