A 90-day declaration that ran for three years

The week

On January 30, 2020, the World Health Organization declared the novel coronavirus outbreak a Public Health Emergency of International Concern. That is the WHO’s highest formal level of alarm for a disease outbreak, a signal to governments everywhere that coordinated action is needed.

The declaration came at the second attempt. The WHO’s Emergency Committee had met on January 22 and 23 and decided that a declaration was premature. A week of rising case counts in China, and confirmed cases in a growing number of other countries, changed its assessment when it reconvened on January 30.

The American picture moved quickly in the same days. The first US case had been confirmed on January 21, in Washington state. On January 30, the Centers for Disease Control and Prevention confirmed the first known person-to-person transmission inside the United States: the husband of an Illinois woman who had returned from Wuhan. On January 31, the CDC issued a federal quarantine order for 195 Americans evacuated from Wuhan and housed at March Air Reserve Base in California. Officials described it as the first order of its kind in more than 50 years.

Also on January 31, the Secretary of Health and Human Services, Alex Azar, declared a public health emergency under Section 319 of the Public Health Service Act, effective from January 27. Section 319 is the part of federal law that lets the Secretary formally declare that a public health emergency exists. It confers few powers in itself; once it is in place, a range of other legal tools, funding mechanisms and flexibilities can be connected to it.

The same day, the President signed a proclamation suspending entry for most foreign nationals who had been in mainland China during the previous 14 days. It took effect on the afternoon of February 2, with exceptions for groups such as US permanent residents and close family members of citizens.

More instruments followed within days, each on its own legal footing. On February 4, the Secretary made a separate determination under Section 564 of the Federal Food, Drug, and Cosmetic Act. That determination was the basis on which the Food and Drug Administration could later authorize tests for emergency use. A declaration under the PREP Act, which provides liability protection for countermeasures, was later issued with effect from the same date. No two of these instruments shared an expiry date.

For most Americans the novel coronavirus was still a story about somewhere else, with only a handful of confirmed US cases. Federal officials said repeatedly that week that the immediate risk to the American public was low; the CDC director said so when announcing the Illinois case. The declarations were presented as ways of keeping it low, and few people outside public health expected them to reach far into ordinary program operations. Yet the declarations made in those few days would shape how hospitals, state agencies and federal programs operated for more than three years.

At the time, the Section 319 declaration was widely read as a precaution. It would let federal agencies move resources and use certain flexibilities, the kind of preparation a sensible government makes before it knows how serious a threat will become.

One detail mattered more than it seemed. A Section 319 declaration lasts 90 days and can be renewed. Nobody that week could know how many times it would be renewed, or how many programs, systems and contracts would come to depend on it. For program directors and CIOs, that small procedural fact would become one of the most consequential features of the next three years, because every 90 days the rules underneath their operations could, in principle, change.

Emergency declarations are designed to be temporary. This one was renewed for more than three years. For agency program directors and CIOs, the January 2020 declaration matters less for what it said than for what came to depend on it.

Its influence divides into three parts. It was a trigger that combined with other authorities. It was a condition that Congress wrote into new law. And it was a clock that ran in 90-day increments. Each created a different kind of technology and compliance debt, and each had to be paid down separately when the emergency ended.

The analysis below opens with a short primer on how declarations, eligibility rules and system switches connect. It then takes the three parts in turn. After that it follows how the debt built up inside one hypothetical agency, counts who paid when the rules switched back, and sets out how to build the exit in from the first day.

“Debt” is a useful word here. Technology teams talk about technical debt: shortcuts taken today that must be repaid, with interest, later. A quick fix to get a system working under pressure solves today’s problem, but someone must eventually go back, understand what was done and undo or redo it properly. The longer the shortcut stays in place, the more other things are built on top of it, and the more expensive the repayment becomes. Emergencies generate this kind of debt at speed, and the January 2020 declaration generated it for three years.

Declarations, eligibility rules and switches

What a declaration actually does

A public health emergency declaration is a formal legal finding. On its own, a Section 319 declaration gives the Secretary limited tools. Its real importance is that many other laws, regulations and programs are written to switch on, or switch off, when such a declaration exists. It works like a building’s fire alarm. The alarm itself does not put out fires, but it unlocks the emergency exits, recalls the elevators and summons the fire service. Each of those responses is wired separately, and each has its own rules for when it resets.

Several declarations, several clocks

The federal response to COVID-19 rested on at least five distinct legal instruments, and each ran on its own terms.

• The Section 319 public health emergency, declared by the HHS Secretary, lasting 90 days unless renewed.
• A national emergency under the National Emergencies Act, declared by the President in March 2020, which lasts until it is terminated or not continued.
• Stafford Act declarations, which route disaster funding through the Federal Emergency Management Agency.
• Section 564 declarations under food and drug law, which support emergency use authorizations and stay in force until the Secretary ends them.
• The PREP Act declaration, which sets liability protections and was amended many times on its own schedule.

Underneath the federal layer sat state emergency declarations, issued by governors under state law. Those carried their own powers, often over procurement, professional licensing and public meetings, and their own limits. Several state legislatures and courts curtailed governors’ emergency powers during 2020 and 2021, so the state layer moved on its own timetable too.

For an operations leader, the consequence is simple to state and hard to manage. “The emergency” was never a single switch. A hospital, a county or a state Medicaid agency could be relying on four or five different legal bases at once, any of which could end on a different day.

How rules become software

Government programs such as Medicaid are run by large computer systems. An eligibility system, for example, is the software a state uses to decide who qualifies for coverage, based on income, household size and other rules. It sends notices, schedules renewals and, when someone no longer qualifies, ends their coverage. Every rule in law becomes a rule in that software. When the law changes temporarily, someone has to change the software, and remember to change it back.

Many states run integrated eligibility systems that serve Medicaid, the Supplemental Nutrition Assistance Program (SNAP) and cash assistance from one platform and one case record. That saves money and spares families from applying three times. It also means a change made for one program can touch the others, because they share data, notices and caseworker screens.

Changes to these systems are usually made by an outside vendor under a formal contract amendment, and the federal government pays a large share of the cost of Medicaid eligibility systems. Each change therefore leaves a paper trail in procurement and federal funding documents, even when it leaves no clear trail in the software itself.

Configuration flags

One way to make temporary changes safely is to build them as configuration flags. A flag is a setting built into the software, so the new behavior can be turned on or off without rewriting the program. If an emergency rule is built as a flag, ending it can be as simple as flipping the switch and testing that everything works as before. If it is built by editing the program’s logic directly, ending it means more programming, more testing and more risk.

Flags are safer, but they are not free. The better designs use effective dates rather than simple on-off switches, so the system applies the emergency rule to cases in a defined window and the normal rule outside it. That matters when an end date is set in law and applies to renewals due after a particular month, rather than to everything at once.

Flags also need housekeeping. A flag that nobody owns, with no expiry and no test of its “off” position, becomes a hazard of its own. Securities markets saw the extreme case in 2012. According to the SEC’s 2013 order against Knight Capital, a flawed deployment set off a function the firm had left dormant in its order router. The firm lost more than $460 million. Dormant code that nobody remembers is dangerous in any regulated system.

A trigger for other authorities

A Section 319 declaration on its own gives the Secretary limited tools. Its reach comes from what it combines with. Section 1135 waivers of certain Medicare, Medicaid and CHIP requirements, for example, need both a public health emergency and a separate presidential declaration under the Stafford Act or the National Emergencies Act. Those came on March 13, 2020. Once both were in place, the federal government could relax a long list of requirements on providers and states.

What the waivers touched

For hospitals, the blanket waivers changed rules that normally drive billing and patient flow. One example was the Medicare requirement for a three-day inpatient stay before skilled nursing facility care is covered. Others let hospitals treat patients in spaces outside their usual buildings. Each waiver changed what a claim needed to contain, so it had to be reflected in registration screens, coding rules and claims edits.

For state Medicaid agencies, the tools were different. States requested their own Section 1135 waivers, filed disaster relief amendments to their state plans and used a standard appendix to adjust home and community-based services waivers. Each approval had its own scope and end condition, and some were tied to the federal emergency while others carried their own dates.

Health systems also relied on a flexibility from a different office altogether. In March 2020, the HHS Office for Civil Rights said it would not penalize providers for using everyday video tools for telehealth in good faith during the emergency. That applied even where those tools would not normally meet HIPAA requirements. That notice was tied to the public health emergency. A hospital that moved hundreds of clinicians onto consumer video apps had taken on a dependency that would need a signed business associate agreement, or a different tool, once the emergency ended.

Separate instruments, separate questions

Other instruments ran on separate tracks. A declaration under the PREP Act, issued in early 2020 and amended many times, provided liability protections for countermeasures such as tests and, later, vaccines. Emergency use authorizations by the Food and Drug Administration rested on yet another determination. Each had its own duration and amendment history. For an agency running a testing or vaccination program, the practical question was which instrument covered which activity, and when each would lapse.

These were separate legal permissions, each answering a different question. Liability protection answers who can be sued if something goes wrong when a test or vaccine is given. An emergency use authorization answers whether a product may be used before it has completed the normal approval process. A waiver answers which routine rules a hospital or state may set aside. A testing site could depend on all three at once, and each could change on its own schedule. For the people running such a site, knowing which permission sat behind which activity decided what they could keep doing the morning after any one of them changed.

State Medicaid agencies and health departments therefore operated under rules that changed by reference to other documents. Systems had to be configured for waived requirements, and staff had to track which flexibility rested on which authority. Few agencies kept a register that mapped each operational change to its legal basis.

The register that was missing

A register needs only a handful of fields:

• the change;
• the program;
• the authority relied on;
• the system configuration affected;
• the owner;
• the expected end.

Three more fields make it far more useful when the end arrives: the date and approver of the change, the evidence that it was implemented as approved, and whether a test of the return to normal rules exists. An auditor or federal reviewer reconstructing the period later will ask for exactly those things.

Its absence made the eventual unwinding much harder. Suppose a state health services department, over the course of the emergency, relaxes a documentation requirement for one program, extends a deadline in another and allows a type of remote service in a third. Each change is approved by a different team, under a different authority, and implemented by a different vendor. Two years later, when an end date is announced, nobody can produce a single list of what was changed, why and on what legal basis. The agency must reconstruct it from emails and change orders while the clock runs.

How the trigger looked by type of organization

The same dependency took different forms depending on who held it. A health system’s exposure ran through its compliance office and revenue cycle, because waivers changed what could be billed and how. A state Medicaid agency’s exposure ran through its eligibility and claims systems and its federal approvals. A county health department’s exposure ran through testing and vaccination operations, staffing and state emergency orders. Each needed the same register, owned by a different person.

A condition written into new law

In March 2020, the Families First Coronavirus Response Act gave states a 6.2 percentage point increase in the federal share of Medicaid costs. The conditions included keeping eligibility rules no stricter than before and covering COVID-19 testing and treatment without cost sharing. The most consequential condition was that states keep most enrollees covered continuously until the end of the month in which the public health emergency ended.

That tied eligibility processing in every state to the declaration. Redeterminations, the periodic checks of whether people still qualify, would normally remove people who no longer did. They were largely paused, and enrollment rose substantially. KFF, the health policy research organization, reported that Medicaid and CHIP enrollment grew by about 21 million people between February 2020 and the end of 2022, to more than 92 million.

What the condition did to systems

This is where the declaration turned into a systems issue. Eligibility platforms had to suppress normal terminations while continuing to process changes that kept people covered. They also had to record who would otherwise have lost coverage, and keep the contact information and case details needed to renew them later. Mailing addresses aged during the pause, because people moved while no renewal notices were being sent.

Integrated systems made this harder. SNAP ran on its own federal waivers and timelines, so the same household could have a Medicaid case under paused rules and a SNAP case under different ones. Caseworkers moved between the two on the same screens. Notices generated from shared templates had to say different things for each program.

Agencies that kept clean records of deferred actions, and that kept updating addresses through other programs and data sources, were far better placed when the pause ended. Those that simply switched rules off faced a backlog of unknown size, with stale contact data and caseworkers who had not processed a normal renewal in years.

Data that decays while nothing happens

Contact data deserves its own plan because it decays without anyone touching it. Practical sources for keeping it current included the US Postal Service’s change-of-address data, updates held by Medicaid managed care plans, and addresses captured when the same household dealt with SNAP or other programs. When the unwinding came, CMS offered states temporary waivers that let them accept some of these updates with less manual checking. Agencies that had already built the data feeds could use them at once. Others spent the first months of the unwinding building them.

The same logic applies to the data behind automatic renewals. Many states renew some people without a form, by checking state wage records and other electronic sources. Those checks depend on data-sharing agreements and interfaces that also aged during the pause. A renewal process that relies on a feed nobody has tested in three years is a risk, whatever the policy says.

People, vendors and the restart

The same pattern affected workforce planning. Staff who had handled renewals were reassigned to other work during the pause, and some left. Training materials and system knowledge faded. An agency that wanted to restart renewals at scale needed caseworkers, call center capacity and notices tested against current system logic, all at the same moment. Planning for that restart had to begin long before the end date was known, which meant budgeting for capacity against a date that kept moving.

Vendors were caught up as well. Eligibility system contractors had built suppression logic under change orders, the formal contract amendments that authorize and pay for changes to a system. Reversing it required further change orders and full testing cycles. Agencies that had asked vendors to document every emergency modification could scope the reversal quickly. Others had to reconstruct what had been changed.

Administration structure changed the shape of the problem. In states where counties carry out much of the eligibility work, such as California and New York, the restart depended on dozens of local offices with their own staffing, training and backlogs. A state-administered program could plan centrally but had a single point of failure in its central call center and processing unit.

The case for the condition

The continuous enrollment condition did what Congress intended. It kept people covered through a public health crisis, at a time when job losses and office closures would otherwise have driven many people out of coverage. The debt it created was a known price of that policy choice, and arguably a reasonable one. The criticism here is narrower. Agencies could have paid the price more cheaply by recording what they deferred and keeping the machinery for renewals in working order.

A clock that ran in 90-day increments

Because a Section 319 declaration lasts 90 days, the emergency was renewed repeatedly. In January 2021, HHS wrote to governors that the emergency would likely last through the rest of that year and that states would receive 60 days’ notice before it ended. That helped, but agencies still could not plan beyond a few months with confidence. Temporary arrangements, from staffing models to vendor contracts to system configurations, stayed temporary in name while becoming permanent in practice.

How short horizons shape decisions

Short horizons push agencies toward workarounds. Contract modifications, manual overrides and spreadsheet trackers accumulate when nobody can justify a proper change for a rule that might end next quarter. Each workaround is a small liability that must be found and removed later, often by staff who were not there when it was created. Vendor contracts extended in 90-day steps also cost more and left agencies little room to negotiate.

Procurement rules add to the pressure. Emergency purchasing authority under state law usually allows faster, less competitive buying for a limited time and a limited purpose. As the emergency dragged on, agencies faced a choice between running a full competition for work that might end soon or stretching emergency authority further than its authors intended. Neither option is comfortable, and both leave a record that auditors later read.

There is a human side to this too. Take a program manager who is asked, every quarter, whether to invest in doing something properly or keep the temporary fix running for another three months. Each time, the temporary fix wins, because it is cheaper this quarter. Over a dozen quarters, the agency ends up running a substantial part of its operations on arrangements that were never designed to last and that few current staff fully understand.

The case for a short clock

The strongest objection to this argument is that the 90-day limit is a safeguard, not a flaw. Emergency powers should expire unless someone actively renews them, and a short clock forces that decision. That is right. The clock worked as a check on the declaration itself. What it did not do was prompt anyone to review the dependencies that had grown up underneath it. Each renewal was a natural checkpoint for reviewing the register of emergency changes, and few agencies used it that way.

Designing for the exit

A better pattern is to design emergency changes as reversible from the start. Configuration flags that can be switched off cleanly, test scripts for the return to normal rules, and a scheduled review of every emergency change each quarter keep the eventual exit manageable. Counsel should confirm which authority applies to which change, because the answer is rarely obvious and often differs by program. The same discipline applies to any declared emergency, whether a pandemic, a natural disaster or a financial shock.

Contracts can carry part of the load. A vendor change order for an emergency modification can require, as a deliverable, a written description of the change, the flag or parameter that controls it, and a test script for turning it off. That costs a little more at the start. It saves a great deal when the agency later needs to scope the reversal and has the vendor’s own documentation in hand.

How the debt builds up inside an agency

Follow a single, hypothetical state Medicaid agency over time, because the problem comes from many small, reasonable decisions rather than one big one.

In the spring of the first year, the agency receives guidance that it must keep enrollees covered to receive the extra federal funding. The eligibility system vendor is asked to stop ending coverage for most people. Under time pressure, the quickest route is to add a check deep inside the termination logic: if the emergency is in effect, skip this step. It works. Coverage continues, and the agency moves on to the next urgent request.

Over the following months, more requests arrive. Some notices are suppressed because they would confuse people whose coverage is not changing. Some workflows for caseworkers are simplified. A report is built to count people who would otherwise have lost coverage, but it is maintained by one analyst in a spreadsheet. Each change is sensible in isolation, and each is documented, if at all, in its own change order.

By the second year, the people who made the first changes have moved roles or left. The vendor has updated the system several times for other reasons, and some of those updates interact with the emergency logic in ways nobody fully mapped. New caseworkers have been hired and trained only on the emergency version of the process. They have never seen a normal renewal.

The test environment drifts too. The copy of the system used for testing is refreshed less often than it should be, and the batch jobs that run normal renewals have not run in production for a long time. When someone finally tests them, they run against data that no longer looks like the live caseload.

By the third year, when an end date finally arrives, the agency must answer questions nobody planned for: which parts of the system behave differently because of the emergency, what happens when the check is removed, which notices need to go back on and whether their templates are still accurate, and which enrollees would have lost coverage and where they live now. Nobody was incompetent. This is what happens when temporary changes are made one at a time, under pressure, with no shared map of what depends on what.

Signals a director can measure

The build-up is visible to anyone who asks for the right numbers. A program director can track, each quarter:

• the number of active emergency changes, and the age of the oldest;
• the share of those changes with a named owner, a recorded legal basis and a tested reversal;
• the number of deferred actions, such as paused terminations, and the share with contact details verified in the past year;
• the number of staff who have completed a normal-rules transaction in the past year;
• the number of emergency change orders with no stated end condition.

Collecting these numbers needs no new technology. It needs someone to own the list and report it to the same meeting every quarter.

Who pays when the rules switch back

This administrative detail has serious consequences, and they fall on different parties.

People and the agencies that serve them

For the people served, the stakes are direct. When an eligibility system switches back to normal rules, errors in its logic mean that people who still qualify can lose health coverage, often without knowing why. A family that loses coverage by mistake may find out only when a child is turned away at a pharmacy.

For the agency, the costs come in several forms. Reconstructing undocumented changes consumes scarce staff and vendor hours. Backlogs generate complaints, appeals and political attention. Federal oversight bodies can require corrective action. And the agency’s reputation, with the public, with legislators and with its federal partners, depends on handling the transition competently.

The law that ended continuous enrollment gave CMS sharper tools for that oversight. It could require a corrective action plan from a state that fell short of federal renewal or reporting rules, and order a pause in procedural terminations if the plan was not delivered. Civil money penalties were also available. States that missed reporting requirements faced a reduction in their federal matching rate. Oversight was no longer abstract. A state without clean records of what it had changed found it harder to answer CMS’s questions quickly.

Health systems and health plans

Hospitals and clinics bore part of the cost downstream. Patients who lost Medicaid, including many who still qualified, arrived uninsured. That shifted work onto registration staff, financial counselors and charity care programs, and added to uncompensated care. Hospitals that can make presumptive eligibility determinations, a process that grants temporary Medicaid coverage at the point of care, had a tool to soften the effect. It still meant more administrative work for each patient.

Medicaid managed care plans saw membership fall and had to choose how much to spend on helping members renew. Their contact data was often fresher than the state’s, so the effectiveness of the unwinding depended partly on data-sharing arrangements between plans and states that had not been designed for the purpose.

The same pattern in banking

In other sectors the pattern is the same whenever a temporary rule changes how systems behave: payment holidays in banking, regulatory forbearance, emergency staffing rules in hospitals. Banks and credit unions had their own example. Section 4013 of the CARES Act let lenders choose not to treat certain COVID-related loan modifications as troubled debt restructurings. The relief ran until the earlier of a fixed date or 60 days after the national emergency ended, and Congress later extended that fixed date to January 1, 2022. Lenders had to code eligible modifications in their loan systems, track the window and change their treatment when it closed.

The emergency is the easy part to see. The harder part is the slow accumulation of things that depend on it.

Governance

There is also a governance point for boards and senior officials. An emergency tends to concentrate decision-making in a small group moving quickly, which is right at the start. But the longer the emergency lasts, the more those quick decisions harden into the way the organization works, without ever passing through normal review. A regular, senior-level look at the full list of emergency changes is how leaders reclaim those decisions and choose deliberately which to keep, which to make permanent properly and which to unwind.

Building the exit in from the start

An organization that manages emergency changes well tends to do five things. It keeps a single register of every emergency-driven change, with the legal basis and the owner. It builds changes as switches that can be turned off cleanly, with tests for turning them off. It records the actions it defers, so they can be resumed accurately. It reviews the whole list on a schedule, rather than only when an end date is announced. And it plans the workforce and vendor capacity for the return to normal, long before the date is known.

A sequence for the exit

When an end date is announced, the work follows a natural order:

1. Confirm the register is complete, by comparing it against change orders, policy memos and system release notes from the emergency period.
2. Group each change by the authority it rests on, and confirm with counsel which end date applies to each group.
3. Decide for each change whether to unwind it, keep it under a new permanent authority, or extend it where the law allows.
4. Run the reversal in a test environment refreshed with recent, realistic data, and compare results against the normal rules case by case.
5. Rehearse the restart with staff, the call center and the vendor, using real notices and real scripts.
6. Monitor the first weeks closely, with daily counts of terminations by reason, so defects show up in days rather than months.

The last step is the one most often skimped. A sudden rise in procedural terminations, or in terminations concentrated in one household type, is the signal that system logic is wrong. Agencies that watched those counts daily could pause and fix problems before they reached large numbers of people.

Roles and evidence

Ownership should be explicit. The program director owns the decision to keep or unwind each change. Counsel owns the reading of the authority. The CIO or system owner owns the configuration and the reversal test. The vendor manager owns the change orders. Communications owns the notices and the public explanation. When an auditor or federal reviewer arrives, the evidence they ask for is the register, the approvals, the test results and the monitoring data. An agency that has those to hand spends days on the review, not months.

The cost of discipline

The obvious objection is that nobody has time for a register in the first weeks of a crisis. That is fair, and the answer is to capture changes after the fact. A weekly half-hour in which each team lists what it changed, and on what authority, is enough to keep the register current. The cost is small set against the months of reconstruction that agencies faced in 2023.

The failures are just as consistent: treating each emergency change as a one-off rather than as part of a portfolio; editing core logic instead of adding a switch; letting contact data go stale because no notices are being sent; allowing staff skills in normal processes to fade without a plan to restore them; extending vendor contracts a few months at a time without documenting what each change did; and assuming that whoever made a change will still be there to undo it.

What a program director should be able to show about emergency changes

These five questions can be put to any program team, in any emergency, and the answers will show quickly whether an exit is planned or improvised.

1. Can you show me a single list of every change we have made because of an emergency, with the legal authority each one rests on?
2. For each of those changes, who owns it, and what is its expected end date or trigger?
3. Which of these changes were built as switches we can turn off, and which required rewriting how our systems work?
4. What actions have we deferred, such as renewals or terminations, and do we have current contact details for the people affected?
5. If the emergency ended in 90 days, do we have the staff, call center capacity and vendor support to restart normal processing at scale?

A team that can answer all five in a single meeting has an exit plan. A team that needs a week to answer the first has a reconstruction project waiting for it.

With hindsight

The federal public health emergency was renewed more than a dozen times. In January 2023 the administration announced that it intended to let it expire, and it ended on May 11, 2023, more than three years after it was declared as a 90-day measure.

The other clocks stopped on different days. The national emergency ended a month earlier, on April 10, 2023, when President Biden signed a joint resolution of Congress terminating it. Emergency use authorizations did not end with the public health emergency at all, because they rested on separate Section 564 declarations that stayed in force. Organizations that had treated “the emergency” as one switch had to sort out which of their arrangements followed which date.

Congress had already decoupled the biggest dependency. The Consolidated Appropriations Act, 2023, signed on December 29, 2022, ended the Medicaid continuous enrollment condition on March 31, 2023, and phased down the extra federal funding through the end of 2023. The same law ended SNAP emergency allotments after February 2023 and extended Medicare telehealth flexibilities through the end of 2024. So the most consequential dependencies were cut loose from the declaration before the declaration itself ended, exactly the kind of shift a register of dependencies is designed to track.

Other flexibilities ended on their own terms. The HHS Office for Civil Rights’ enforcement discretion for telehealth expired with the emergency. A transition period followed until August 9, 2023, by which point providers were expected to have compliant tools and business associate agreements in place. Medicare telehealth flexibilities went the other way. Congress extended them several times, they lapsed briefly during the federal government shutdown in the fall of 2025, and the Consolidated Appropriations Act, 2026, signed in February 2026, extended them through the end of 2027. A piece of the 2020 emergency was still running on temporary extensions six years later.

States then began an eligibility renewal effort of a scale the program had never seen, and many struggled with backlogs, procedural terminations and system defects. A procedural termination is when someone loses coverage not because they were found ineligible but because a step in the process was not completed, for example a form was not returned or a notice went to an old address. KFF’s tracker, in its final update in 2024, counted more than 25 million people disenrolled during the unwinding, about seven in ten of them for procedural reasons.

On August 30, 2023, CMS told states that some were running automatic renewals at the household level rather than for each individual, and required those affected to pause procedural terminations, fix their systems and reinstate people wrongly cut off. In practice, a system checking a whole household together could drop children who still qualified because a parent no longer did. By late September, 30 states had reported the problem and nearly 500,000 people were set to regain coverage.

That finding is the clearest evidence for the argument here. The defect lived in renewal logic that had barely been exercised for three years, and it surfaced only when the rules were switched back on at scale. Software that is not used tends to drift out of step with the rules it is meant to apply, and the people who knew how it behaved move on.

What held up less well was the assumption, common in 2020, that the hard part would be the emergency itself. For eligibility agencies, the hardest year was 2023, when the emergency was over and the deferred work came due all at once.

The same systems now face another large rule change, this time with a date fixed in advance. The budget reconciliation law signed on July 4, 2025 requires states to check eligibility every six months for adults covered under the Medicaid expansion. It also requires states to apply work requirements to many of them. Both begin on January 1, 2027. By this point in 2026, state agencies and their vendors are building those rules into the platforms that struggled during the unwinding. The difference is that this change is known in advance, so the register, the tests and the monitoring can be in place before the first notice goes out.

The declaration that looked like a precaution in January 2020 shaped three years of program operations and a difficult year of unwinding. Whatever the next emergency is, the exit plan should start on the day it begins.