Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both

The week

On June 1, 2026, CMS, the Centers for Medicare & Medicaid Services, issued an interim final rule implementing the Medicaid community engagement requirement created by the July 2025 budget reconciliation law. An interim final rule is a regulation that takes effect before the public comment process is complete, with changes possible afterward. It was published in the Federal Register on June 3, with comments due and the rule taking effect on July 31.

Take a woman in her fifties with serious heart failure. Some weeks she can barely climb the stairs to her apartment. She is covered by Medicaid, the joint federal and state program that pays for health care for people with low incomes. Under a new federal law, many adults on Medicaid must now show that they work or take part in similar activities to keep their coverage. People like her are meant to be exempt. Whether the system recognizes that may depend on something she has never seen: the codes on her medical bills.

The basics are these. Adults aged 19 through 64 in the affected group must show 80 hours a month of work, education, a work program or community service, or equivalent income, unless exempt. States must implement by January 1, 2027. Exemptions include pregnant and postpartum individuals, tribal members, certain caregivers and people who are medically frail.

The rule set out how states should identify medical frailty: through defined condition categories, state-maintained lists of ICD-10 codes, and claims and administrative data first. ICD-10 is the standard catalog of diagnosis codes used on medical bills in the United States. Every diagnosis a clinician records for billing, from a sprained ankle to schizophrenia, is translated into a short alphanumeric code. Claims are the bills that providers send to Medicaid and its plans, and they carry those codes.

So the first place a state will look to decide whether someone is too sick to be required to work is the trail of diagnosis codes in their recent bills. That trail is written not by the state, and not by the patient, but by doctors, clinics, hospitals and the coding staff who turn clinical notes into claims.

In early July, health systems and Medicaid plans were reading what that meant for them. For many, it was the first time eligibility for public coverage had depended so directly on the quality of their own records.

The interim final rule added a detail that moves part of the work from state agencies to providers.

Medical frailty is one of the broadest exemptions, and the rule ties it to diagnoses that appear in claims and records. It also says a diagnosis alone is not enough: the record must show that the condition significantly impairs the person’s ability to meet the requirement. That makes the quality of clinical documentation and coding a factor in whether an exempt person is recognized as exempt.

For health systems and the plans that pay them, three parts of the chain matter, in the order a case moves through it: how conditions are coded, how frailty is documented when the data falls short, and how that information reaches the state. First, how the machinery works.

How a diagnosis becomes a line on a claim

When a patient sees a clinician, the clinician writes notes in the electronic health record, the hospital or clinic’s digital chart. Those notes are written for other clinicians, in clinical language. To get paid, the provider must translate the visit into a claim: a structured bill listing what was done and why. The “why” is expressed as ICD-10 diagnosis codes.

That translation is done by a mix of clinicians, software and professional medical coders. It resembles turning a nuanced conversation into a short list of keywords, and much depends on how specific the translator is. A code can describe a general symptom, such as shortness of breath, or a specific underlying condition, such as a particular type of heart failure. Both may be accurate. Only one tells a reader how sick the patient really is.

Claims flow to the payer. In Medicaid, that is either the state directly or, more often, a managed care plan: a private insurer the state pays to manage care for its Medicaid members. Plans then report encounter data, records of the services their members received, to the state. Over time, the state builds up a picture of each member’s diagnoses and care from these records. That picture is what the rule asks states to check first.

Two other terms will come up. Clinical documentation improvement is a hospital program in which specialists review records and ask clinicians to clarify vague or incomplete notes, so that the coded record reflects the patient’s real condition. Risk adjustment is the practice, in some insurance programs, of paying more for sicker patients based on their coded diagnoses. Both have taught health systems a great deal about coding accuracy. The frailty rule puts that knowledge to a new use.

How a frailty check unfolds, step by step

Follow a single case through the system the rule describes, in a hypothetical state with a hypothetical member.

First, the state looks at its own data. Before contacting the member at all, it searches the past 12 months of claims and encounter data for diagnosis codes on its frailty lists, and for signs that the condition actually limits the person: serious acuity, heavy use of care, relevant prescriptions, medical equipment. If it finds enough, the member is treated as exempt and may never know a check took place. This is the best outcome for everyone. It costs the member nothing and the state little.

Second, if the data does not settle the question, the state turns to the member. Through 2027 it may accept the person’s own attestation that they are medically frail. Later, documentation such as a provider certification or medical records will generally be needed. This is where clinics come in, and where delays begin to matter.

Third, the check repeats. Frailty must be reverified at least every 12 months, so the member will go through the process again, and the data the state relies on will once more be the previous year’s claims.

Notice who holds the influence at each step. At the first, it rests with whoever wrote and coded the claims. At the second, it lies with whoever answers the certification request. At the third, it depends on whether the patient kept receiving, and being billed for, care over the year. Providers influence all three.

Coding: what the claims say

The rule keeps the five statutory categories of medical frailty and bars states from adding to them. They are blindness or disability; substance use disorder; disabling mental disorders; physical, intellectual or developmental disabilities; and serious or complex medical conditions. States must maintain auditable, regularly updated lists of qualifying diagnosis codes.

Before asking the individual anything, they must check claims and encounter data, but only from the preceding 12 months. According to KFF’s analysis, the rule is explicit that a diagnosis by itself cannot verify frailty. States are left to infer impairment from signals such as acuity, utilization, prescriptions and durable equipment, and to audit their own findings. That means how severe the condition looks, how much care the person is receiving, what medicines they take and whether they use equipment such as a wheelchair or home oxygen.

That design rewards specific coding. Consider the ways a genuinely frail person might be missed.

• A claim coded with a general symptom rather than the underlying serious condition may not match a state list.
• A mental health condition documented in notes but not coded on claims may be invisible.
• A serious condition last treated 13 months ago falls outside the window entirely.
• A coded diagnosis with little treatment recorded around it may not read as impairing.
• Conditions treated outside Medicaid-paid settings, such as at a free clinic or under another payer before enrollment, may not appear at all.

Return to the woman with heart failure. Suppose her cardiologist sees her regularly but the clinic’s claims often list only her symptoms. Or her worst episode, a hospital stay, may have happened fourteen months ago and she has been managed by phone since. In either case, the state’s automated check may find nothing that matches its list, and she may receive a letter asking her to document 80 hours a month of work.

Coding teams already work on specificity for risk adjustment and quality measures. The difference is the stakes. Here a missing code can lead to a request to prove work hours that the patient cannot meet, and possibly to loss of coverage.

Health systems can act on this in familiar ways. They can compare state code lists against their own problem lists and claims for Medicaid patients in the affected age group. A problem list is the running summary of a patient’s active conditions in the health record. They can target documentation improvement at conditions that appear on the lists but are often coded nonspecifically. They can also check that behavioral health and substance use services delivered in their clinics generate claims with diagnoses, which is not always true under bundled or grant-funded arrangements, where a single payment or a grant covers care and no itemized claim is produced.

Documentation: when the data falls short

The rule allows self-attestation of medical frailty only when the state’s own data review cannot verify it. Self-attestation means the person states, in their own words and on their own authority, that they qualify. Through 2027 states may accept it in that situation. From January 2028, according to summaries by KFF and Holland & Knight, attestation is generally available once per continuous enrollment period. Later renewals need documentation, such as a provider certification or medical records. Frailty must also be reverified at least every 12 months.

That sends a new kind of request to clinics. A patient, a plan care manager or the state may ask a physician to certify that a condition significantly limits the patient’s ability to work. Most practices do not have a standard form, a defined turnaround or a clear rule about who signs. Without them, requests will land in inboxes and wait. The renewal clock will not.

Take a busy primary care practice at a community health system. One week, a dozen certification requests arrive: some by fax from the state, some through the patient portal, some from a plan care manager by email, a few handed over in person by patients. They go to different staff. Some reach the right physician; others sit in a shared inbox. Each physician writes something different, a sentence here, a full letter there. Some list a diagnosis but say nothing about how it affects the patient’s ability to work, which the rule requires. Weeks later, several patients return, confused, with notices that their coverage is at risk.

A workable process has four elements.

1. There should be one intake point for certification requests.
2. There should be a template that maps to the state’s categories and asks for the functional impact the rule requires as well as a diagnosis.
3. Clinicians need guidance on what they can attest to from the record.
4. And someone should track turnaround against renewal dates.

Health systems should ask counsel how these certifications fit with existing disability and work-capacity forms, and what liability attaches to them. Physicians are being asked to make a judgment with real consequences for their patients, and they deserve clear guidance on how to do it well.

Exchange: how the information reaches the state

The third part is the path from provider to state. Claims reach the state through Medicaid billing, often with a lag. Certifications and records will travel by whatever channel each state designs: portals, fax, plan intermediaries or health information exchanges. A health information exchange is a regional or state network that lets hospitals, clinics and others share patient records electronically.

The rule lets managed care plans do outreach, make referrals and share information with the state, including frailty status, but not make eligibility or compliance determinations. That gives plans a useful role. A plan with claims across many providers may identify likely frailty before the state does, and pass it along in a form the state accepts. Health systems that already exchange data with plans for care management can add frailty-relevant information to those feeds, within privacy rules.

Suppose analysts at a Medicaid plan serving members across a large region notice that a group of members have regular dialysis claims from one provider and oxygen equipment claims from another, but no single claim that combines the serious diagnosis with evidence of impairment. No individual provider sees the whole picture; the plan does. By passing a summary to the state in an agreed format, the plan can help the state recognize these members as exempt before anyone receives a letter. It cannot decide the question itself, but it can make sure the decision-maker has the evidence.

Substance use disorder records under 42 CFR Part 2 need particular care. Part 2 is a federal regulation that gives certain addiction treatment records stronger confidentiality protection than ordinary health records, because of the stigma and legal risk patients can face. Organizations should confirm with counsel what consent or legal basis applies before sharing them for eligibility.

Timing matters as much as content. Claims can take weeks to be submitted and adjudicated, the payer’s process of reviewing and deciding on a bill, so a diagnosis made in December may not be in the state’s data when a January check runs. Newly enrolled adults may have little Medicaid claims history at all. Health systems can shorten the lag by submitting claims promptly for this population and by making sure diagnoses from emergency and inpatient encounters, which often reveal serious conditions first, are coded completely.

What coverage losses cost providers and plans

The work requirement is a state eligibility matter, but providers are participants in it, not bystanders. For a health system or Medicaid plan, the consequences are direct.

• Patients and continuity of care. A patient who loses coverage may stop coming in, stop filling prescriptions or arrive later and sicker in the emergency department.
• Revenue. Patients who lose Medicaid often remain patients, but uninsured ones. Uncompensated care rises, and the people most likely to be affected wrongly are the sickest, who use the most care.
• Staff workload. Certification requests add a new administrative task to clinicians who are already stretched. Without a process, it falls on whoever opens the fax.
• Reputation and mission. Patients will not distinguish between a state’s decision and their doctor’s paperwork. If coverage is lost because a form was never returned, they will remember where it stalled.
• Compliance. Certifications and data sharing carry legal obligations, particularly for protected records, and need the same care as any other disclosure.

A health system that knows where its frail patients stand

A health system in good shape knows which of its Medicaid patients aged 19 to 64 have serious conditions, and whether those conditions appear on recent claims in a form the state will recognize. It has a single, well-run process for certification requests, with a template, guidance and turnaround tracking. It has agreed with the plans it works with how frailty-relevant information will travel. And its coding and documentation teams treat this population as a priority, not an afterthought.

Where it tends to go wrong:

• Assuming the diagnosis is enough. The rule requires evidence of impairment as well as a code.
• Forgetting the 12-month window. A serious condition that has not generated a claim in the past year is invisible to the first check.
• Missing claims for grant-funded care. Behavioral health and addiction services may produce no coded claim at all.
• No owner for certifications. Requests scatter across inboxes and miss renewal dates.
• Sharing protected records casually. Part 2 records need a confirmed legal basis.

Where the coverage risk sits in the record

• Have we compared our state’s frailty code lists against the diagnoses on our Medicaid patients’ recent claims, and where are the biggest gaps?
• Do our behavioral health and substance use services generate claims with diagnoses, including those funded by grants or bundled payments?
• Where will a frailty certification request arrive, who will handle it and how fast will we respond?
• Does our certification template ask clinicians to describe how a condition limits work as well as name it?
• Have we agreed with our Medicaid plans how frailty-relevant information will reach the state?

With hindsight

Nebraska began enforcing its requirement on May 1 and has supplied the first evidence; most other states are now less than three months from the January implementation date. Its health department reviews claims about 90 days before renewal and treats members with qualifying diagnosis or procedure codes as exempt without further action. That is the data-first approach the rule describes, working as intended for people whose records are complete.

KFF’s September analysis of Nebraska’s data found medical frailty accounted for 39% of exclusions at renewal in July and August, and that most coverage losses followed non-response to information requests. Both findings matter. The first shows how much weight the frailty exemption carries, and therefore how much depends on accurate coding. The second shows that when the data does not settle the question, the burden shifts to people answering letters, and many do not.

Renewing members have claims history that new applicants lack, which is the gap described here. A person newly enrolling, or one whose serious condition has gone untreated or uncoded, starts with little for the state to find.

The stakes are large. In the rule’s impact analysis, CMS projected that enrollment would fall by 2.3 million people in fiscal 2027 and by 3.1 million to 3.3 million a year after that. The frailty test is also being litigated: in late June, attorneys general from 24 states, counting the District of Columbia, and two governors sued to challenge the two-part test.

How many losses fall on people who should have been exempt will not be measurable until 2027 renewals. That uncertainty is a reason for providers to act now rather than wait. The coding, certification and data-sharing work described here is useful whatever the courts decide, because it makes the record more accurately reflect how sick patients really are. The comment period closed on July 31, and organizations should watch for revisions to the rule.