Center for Federal Accountability

CMS proposes holding back Marketplace subsidies until eligibility data is verified, and ending automatic renewal of subsidies

A CMS proposal would stop paying Marketplace premium tax credits while an applicant's data mismatch is unresolved and make about 5.7 million enrollees confirm their information each year to keep subsidies; CMS projects 332,500 fewer enrollees and $7.6 billion less in tax credits a year from 2028. Comments close November 27, 2026.

2026-10-28 · Centers for Medicare & Medicaid Services, Health and Human Services Department · Information · Docket CMS-9873-P

On October 27, 2026, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule to carry out the eligibility checks that Congress added to the premium tax credit in section 71303 of Public Law 119-21, enacted July 4, 2025, which the rule calls the Working Families Tax Cut legislation (91 FR 67656). The changes to the health insurance Exchanges, or Marketplaces, would apply from plan year 2028. Comments are due November 27, 2026, under file code CMS-9873-P (RIN 0938-AW03), on regulations.gov docket CMS-2026-3367. The Federal Register record checked at CFA's October 27 refresh pointed to a general HHS listing rather than that docket, so CFA could not confirm a comment count.

## What would change

Today, an applicant whose information does not match federal data, which the rule calls a data matching issue, generally keeps receiving advance payments of the premium tax credit and cost-sharing reductions during a 90- or 95-day inconsistency period while sending documents (91 FR 67658). Under proposed § 155.315(f)(4)(ii), Exchanges could not pay either subsidy while a data matching issue on citizenship or lawful presence, residency, household income or family size, or other coverage is unresolved. People enrolling through a special enrollment period after a change in family size, such as a birth or adoption, would be exempt (91 FR 67663). Applicants could instead "pend" a plan selection, so that coverage starts only once the issue is resolved, with new start dates keyed to the 15th of the month (proposed § 155.400(i), 91 FR 67657–58).

Second, subsidies would no longer renew automatically. Under proposed § 155.335(a)(1), an Exchange could not find an enrollee eligible for subsidies for the next year unless the enrollee provides or confirms household income and family size, citizenship or eligible immigration status, other coverage and place of residence between August 1 and December 31, and the Exchange verifies it. Enrollees who do nothing would still be re-enrolled in a plan, but at full price (91 FR 67680–82). CMS says it would propose this requirement under its Affordable Care Act authority even if the new statute did not require it (91 FR 67681).

Third, every Exchange would have to open a pre-open enrollment verification period each year on August 1, starting August 1, 2027, in which anyone may provide household income, citizenship or lawful presence, incarceration status and residence for the next year (proposed § 155.410(h), 91 FR 67691). The statute makes such a process a condition of the tax credit (26 U.S.C. 36B(c)(3)(A)(ii), as added by section 71303(b)).

## Residency and family size

CMS proposes no change to residency checks but asks whether the final rule should require new ones. Exchanges on the federal platform check only that an address exists in Postal Service records, not that the applicant lives there (91 FR 67661). A 2024 pilot with LexisNexis found address data for "about half" of the pilot population, and CMS concluded the service did not meet the regulatory standard (91 FR 67661–62). CMS says it is "considering requiring Exchanges to use federated ID verification," tying an address to a verified identity, and asks whether states could share residency data with HHS and other Exchanges through the Federal Data Services Hub (91 FR 67662).

On family size, CMS reports that IRS household-size data could not be returned for 13,423,627 of 30,328,781 applications in plan years 2024 and 2025, about 44 percent, and keeps the current rules (91 FR 67676).

## The numbers

CMS estimates that 3,969,403 enrollees on the federal platform and 1,703,494 in State Exchanges who would have been renewed without acting would now have to return each year, at 30 minutes each, or $72,556,353 a year in their time. It expects 1,289,913 more federal-platform enrollees to receive data matching issues, adding 1,749,325 issues that would take 2,099,190 staff hours, or $109,409,783 a year, to process (91 FR 67698–99). Added checks with Homeland Security's SAVE immigration-status service, the Social Security Administration and a contracted income-data service would cost $9,142,423 a year; CMS withholds per-check prices, citing its contracts (91 FR 67703–04).

The impact analysis projects 332,500 fewer enrollees a year (237,500 on the federal platform and 95,000 in State Exchanges), $7.6 billion less in advance tax-credit payments from 2028, and premiums 0.4 percent higher as "younger and healthier" people leave (91 FR 67707–09). CMS says these losses fall on properly enrolled consumers, beyond the drop in improper enrollment already in its baseline from the 2027 payment notice. It also counts a $3.81 billion yearly "gross net benefit" from "interrupted coverage," equal to half of the forgone tax credit, by valuing coverage people decline at the midpoint between the subsidized and full price (91 FR 67708).

CFA recomputed the burden and impact figures; they add up, with three exceptions. The accounting table gives the premium increase as "0.4% or $2.89 PMPM"; $2.89 is the change in average claims per member per month ($723.98 minus $721.09), while 0.4 percent of the $838.48 premium CMS uses is about $3.35 (91 FR 67709–10). Table 3, titled as annual burden, includes one-time system costs for 2026 and 2027, such as $68,323,800 for the data-matching changes (91 FR 67700). And one citation to the 2027 payment notice reads "97 FR 29526"; the notice is at 91 FR 29526 (91 FR 67671).

## CFA's observations

The proposal would run more personal information through more checks, possibly including identity services and state data shared among Exchanges. CFA observes that it mentions privacy once, saying pre-filled applications could use trusted data "where allowable under privacy and data use agreements" (91 FR 67694). It does not cite the Privacy Act, a system of records notice or a privacy impact assessment.

The notice covering Exchange records is "Health Insurance Exchanges (HIX) Program," No. 09-70-0560. CMS's February 2026 matching notice with the Social Security Administration describes it as "last published in full at 78 FR 63211 (Oct. 23, 2013) and amended at 83 FR 6591 (Feb. 14, 2018)," the 2018 change being an HHS-wide addition of two breach-response routine uses. The 2013 notice already describes identity proofing through "a third party data verification source" and records from "third party data sources." Whether it covers federated identity services or a state-to-state residency exchange is a question the proposal does not address.

CFA also observes that the statute lets an Exchange "use any data available to the Exchange and any reliable third-party sources" in collecting information for verification by the applicant (26 U.S.C. 36B(c)(5)(F), as added). The proposal does not discuss that clause, which bears on how far Exchanges may pre-fill the yearly confirmation.

## CFA's records on HHS

HHS holds a "Minor" grade on CFA's agency scoreboard, with a composite score of 81.36 based on 4 scored areas, for the October 2026 period. The grade does not measure the Exchanges. CFA's system of records analysis counts 1,205 HHS notices in the Federal Register export as of the October 27, 2026 refresh, up from 1,200, ranking HHS 6th with 5.4 percent of all notices. CFA's linkage report ties 499 Federal Register documents to CMS but has crawled no CMS privacy impact assessment pages (5 for HHS as a whole), so CFA's data cannot show whether a current assessment covers Exchange eligibility checks.

## What to watch

Whether the final rule requires federated identity verification or a state residency-data exchange, and whether CMS publishes an updated system of records notice, matching notices or a privacy impact assessment for those uses.

How many enrollees confirm their information by December 31 in the first cycle, and how many are re-enrolled at full price.

Whether State Exchanges get the earlier first-year start date CMS is considering (91 FR 67683), and how the appeal in City of Columbus v. Kennedy, which CMS says leaves open enrollment dates for 2028 uncertain, is decided (91 FR 67689).

How the final rule lines up with Treasury's companion premium tax credit proposal (91 FR 65494), on which comments close November 30, 2026.

## How to comment

Comments can be filed on regulations.gov under docket CMS-2026-3367, or mailed to CMS, Attention: CMS-9873-P, P.O. Box 8016, Baltimore, MD 21244-8016. Refer to file code CMS-9873-P. CMS says comments must be received by November 27, 2026, and that it posts them publicly, including any personal information in them.

Authorities