Who Was Watching WISeR?

In the summer of 2025, Innovaccer told CMS how long it needed. Its application to join the Wasteful and Inappropriate Service Reduction (WISeR) Model laid out a twelve-month implementation plan: contract execution, system setup, pilot testing, then a soft launch. The go-live target, in the company's own words, was January 1, 2027. ^[1] Live WISeR intake in Ohio began January 5, 2026, with Innovaccer as the reviewer.

The company did not hide the gap. On December 2, 2025, it wrote to CMS: "As mentioned in our disclosures when signing the Participation Agreement we will not have a portal live by the January 5th Go Live Date." It was still setting up a phone line for providers and called it "highly unlikely" it could reliably process prepayment claims by launch. CMS quoted those sentences back to Innovaccer on January 7, in a letter demanding a corrective action plan. ^[2]

CMS had been told three times: in the application, at signing, and a month before go-live. My September case study followed what that decision cost patients and practices. The second EFF release raises a harder question. CMS had hired people whose job was to see problems like this coming. What did they see, and what did they do?

The watchers

On October 16, 2025, CMS issued a task order to Westat for WISeR "Implementation and Monitoring." Innovaccer says it executed its participation agreement the same day. Westat's base year carried $3,557,599. On December 1, CMS issued a second task order to Mathematica to evaluate the model, with $7,578,000 obligated through 2029. Federal spending data show $2.14 million paid to Westat and $992,000 to Mathematica through August 2026. ^{[3, 4]}

CMS's own June 2025 planning document said it would be "ideal" to have an implementation contractor to help run the model and audit participants. ^[5] Ideal turned out to mean eleven weeks before the model's January 1 start.

Westat's statement of work reads like an inventory of everything that later broke. The firm was to "advise the CMS COR immediately of any indication that a potential problem may be developing," propose mitigation for known problems, and "monitor integration points and interdependencies across the entire model." It was Tier 2 support for a help desk serving roughly 34,000 affected providers and suppliers. It was told to "consider the lead time for the Medicare Shared Systems Development Lifecycle (SDLC) and the implications for model implementation." ^[3]

I searched the status reports, corrective-action letters, vendor responses and CMS email in both EFF releases, several hundred pages, including scanned pages run through text recognition. Neither firm is named. No warning, risk log or monitoring report in those records is identified as Westat's work. If Westat warned CMS that the rollout was not ready, those warnings are not in the public record. CMS should release them, alongside the decisions they informed.

What there was to see

The warnings were not subtle. On December 22, CGS, the Ohio Medicare contractor, reported that only Innovaccer's prior-authorization function could be tested and that "the remainder of their solution will not be available at go live and cannot be tested." ^[6]

In early December, Noridian, the contractor for Arizona and Washington, reviewed a sample program file that used an ICD-10 crosswalk to define one WISeR service. It warned that the approach would require changes to Medicare's Common Working File and the participants' platforms, and possibly to the national document exchange. The other contractors agreed. ^[6]

That crosswalk sits squarely in Westat's contract. Westat was to maintain, at least quarterly, a crosswalk linking procedure and diagnosis codes to Medicare coverage policies, identify ambiguities in those policies, and help write the business requirements behind the contractors' system changes. ^[3] It also matters to the Texas wound-care case I documented. A skin-substitute claim for a non-lower-extremity pressure ulcer was suspended for WISeR review, even though diagnosis and treatment site determine the model's scope. The practice had to answer the documentation request while fighting to get the claim back to ordinary Medicare processing. ^[7]

Missed deadlines, moving targets

On January 16, Innovaccer's corrective action plan listed end-to-end testing of its portal as "Not started," due January 31, with the portal due to providers February 5. On January 30, the company told CMS it was on track. On February 6 it opened a limited portal to a selected group of providers. On February 20, CMS issued a formal Performance Notice of Non-Compliance. "There appears only to be a login page," it wrote, "with no ability to create or register a new provider/supplier account." CMS called the missed original and extended deadlines "a significant compliance concern" and warned that further failure "will result in payments being withheld." ^[2]

Innovaccer's February 27 reply is the most revealing document in the set. It said neither the participation agreement nor the Participant Guide, which it cited in a version dated December 23, 2025, defined "minimum viable criteria" for a portal to count as fully functional. CMS, it said, had never put its "New Requirements" in writing. It also said CMS had been told on February 9 that the portal was live, met with the company that afternoon, and raised no concerns about the phased rollout. ^[2]

So a contractor was citing a guide dated thirteen days before live intake and disputing the very criteria CMS used to declare it noncompliant. If CMS wrote those criteria down before launch, it should show where and when. If it did not, it held a participant to a standard it never set, and that failure belongs to the agency.

What fairness looked like on the ground

Virtix, the Washington participant, described its own launch. The provider-enrollment validation tool it was given could not validate providers' PTANs and NPIs. Determinations went out anyway, and cases with mismatched identifiers later had to be "reprocessed" from affirmations and non-affirmations into dismissals. Virtix called it "a program-level infrastructure issue." On January 28 and 29, 64 of its determination letters went out without clinical rationale; Virtix says it reissued them within four days. ^[2]

A determination letter without its clinical rationale leaves a practice nothing to answer. An affirmation or non-affirmation later reprocessed as a dismissal forces the office to revisit a decision the system already issued, and should never have issued.

The tracking numbers that tie a decision to a claim broke down too. More than 500 Virtix submissions were caught in tracking-number delays in the first two weeks. Because the Medicare contractor could not issue the numbers fast enough, Virtix says CMMI approved sending determination letters without them, then reissuing each one later. Virtix acknowledged the two-step process prompted duplicate submissions. ^[2]

The payment formula did not punish any of this. Westat's contract made it responsible for writing the technical definitions of the model's performance and quality measures, up to twelve of them. ^[3] In the first performance period, CMS scored two: timeliness and accuracy. Both were pay-for-reporting. A participant earned full accuracy points by submitting the records CMS requested for audit on time, whether or not the decisions in them were right. ^[6] CMS still ran quarterly accuracy audits and kept its corrective-action powers. Congress should obtain those audit results and see what, if anything, they triggered.

Following the money

Westat's contract also put it inside the payment system. It was to run quarterly reconciliations, track participants not eligible for payment, manage payment restrictions and maintain a no-pay list. ^[3] CMS told Innovaccer on February 20 that continued failure would mean withheld payments.

The first performance period closed March 31, and its final resubmission date was July 28. The reporting guide scheduled first-period reconciliation data for submission by August 4. ^[6] CMS should release those submissions, the reconciliation's status, any advance payments and the payment-restriction history. Was Innovaccer placed on the no-pay list? Were payments withheld, and for how long? Who authorized their release, and on what evidence? Those answers live in records Westat was paid to keep.

The evaluator's calendar

Mathematica was hired December 1, before launch. Its schedule put the kickoff meeting eight weeks after award and the draft evaluation design four months after award, around April 2026, three months into live operations. The draft internal impact memo is due December 1, 2026. The first draft annual report is due July 1, 2027. ^[4]

Its statement of work asks the right questions. It names "delays in medically necessary care, abandonment of care, avoidable hospital admissions, and adverse events" as consequences to study, and asks, "How well did the model's payment approach reward actual performance?" It calls for "rapid-cycle and close-to-real-time production of findings." ^[4]

In March, an Ohio provider described three patients crying at the bedside while waiting on prior authorization for vertebral augmentation. ^[8] Those patients were the unintended consequences this evaluation exists to measure. The draft design for measuring them was not due until April.

What CMS owes the public

CMS paid for implementation, monitoring and evaluation. It should show what that money bought:

1. Westat's risk logs, escalation memos and status reports from October 2025 through April 2026, side by side with CMS's go-live decisions.
2. Every version of the code-to-coverage crosswalk and the change requests built from it, especially for diagnosis-limited services such as skin substitutes.
3. Each participant's payment restriction history, no-pay list entries, withheld amounts and first-period reconciliation.
4. Mathematica's evaluation design, its preliminary findings and any analytic memos CMS requested.
5. A deliverable register for both firms: what was due, what arrived, who accepted it and what was paid.

There is a deadline attached. Westat's first option year is priced at $3,629,808 and would begin January 1, 2027, the same date Innovaccer proposed for its own go-live. ^[3] CMS launched WISeR a year ahead of that date and paid Westat to watch. Before it buys another year of monitoring, it should show the public what the first year bought.