If an algorithm denies your knee surgery, and the human reviewer is not scheduled to look at your case for 83 days, the AI is not approving care faster. It is delaying it.
That is the clearest read from roughly 1,000 pages of internal records the Electronic Frontier Foundation (EFF) released on September 8, 2026, after winning a Freedom of Information Act (FOIA) lawsuit against the Centers for Medicare & Medicaid Services (CMS). The documents describe the first eight months of WISeR, a federal pilot that uses artificial intelligence to gate-keep Original Medicare prior authorization in six states: New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington. What the records show is a program that was sold on speed and oversight and launched with vendors still finishing the software, producing denials and delays that providers describe in language you do not usually see in healthcare filings.
What the FOIA release contains
EFF filed its FOIA complaint on March 25, 2026 after CMS did not respond to records requests about the program. The September release bundles nine document sets: participation agreements with the six WISeR participants, the June 2025 Innovation Center Investment Plan, the WISeR Reviewer Guidebook, the WISeR Data Reporting Guide, Medicare Administrative Contractor (MAC) status report emails, provider feedback survey responses, business associate agreements, and request and submission status data. EFF has also posted the combined records as a single PDF.
The most damaging number, per the EFF post, is 5,944. That is how many prior authorization requests the two named vendors - Virtix and Innovaccer - collectively denied in the first three months. Virtix denied more than it approved in that window and was placed on a Corrective Action Plan. Innovaccer, which handles Ohio cases, told CMS roughly one month before launch that its software still lacked full functionality and testing; the EFF post quotes the vendor warning that “auto-affirming is the only path available” given CMS’s refusal to delay.
What the program was supposed to do
Per the CMS WISeR Model FAQ and a Center for Medicare Advocacy summary, WISeR (the Wasteful and Inappropriate Service Reduction Model) launched on January 1, 2026 (portal opening January 5, services starting January 15) and runs through December 31, 2031, structured as two three-year agreement periods. The pilot targets three service categories: skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis. Six technology companies are listed as participants by Medicare Advocacy: Cohere Health (Texas), Genzeon (New Jersey), Humata Health (Oklahoma), Innovaccer (Ohio), Virtix Health (Washington), and Zyter (Arizona).
The FAQ sets out the contract CMS published for the program: “any recommendations that coverage should not be provisionally affirmed will be made by an appropriately licensed human clinician, not a machine,” “Non-affirmations will require the review of a human clinician and cannot be performed solely by technology,” a 72-hour standard turnaround (2 days for expedited), and a promise to “audit participants to prevent inappropriate denials.” That is the contract EFF’s FOIA release shows is not being honored.
Where the contract is breaking
The delays EFF documented go well past a 72-hour promise. EFF found, in the MAC status emails and submission status data, that one prior authorization request went unanswered for 83 days, and that widespread delays were flagged in January 2026 status reports. The Center for Medicare Advocacy tally is consistent: providers document cases that remained in limbo for over six weeks.
The payment structure is the second failure point. EFF’s reporting adds a critical detail: vendors are paid for denials they issue and are only marginally penalized for low-quality scores, with payment reductions in the 5 to 10 percent range. A vendor that denies aggressively, then loses most of those denials on appeal, has already collected. That is the loop EFF’s records describe, and it is the loop CMS’s own audit promise was designed to prevent.
The third failure is operational. Innovaccer’s pre-launch admission that “auto-affirming is the only path available” reads as a confession that the system was not ready, with auto-approval the only way to keep up with the volume. CMS launched anyway. Virtix then denied more than it approved, and only after the fact was placed on a Corrective Action Plan.
What patients and providers describe
EFF’s reporting pulls the most concrete harm from the provider feedback survey responses and the MAC status emails. The phrases EFF quotes verbatim are not model failures; they are bedside failures. One provider wrote: “We have patients calling our offices crying in pain because their procedures are being delayed while awaiting approvals or guidance tied to this model.” A second wrote: “I HAVE HAD TO WATCH 3 PATIENTS CRY AT BEDSIDE FOR NOT HEARING BACK ON THEIR PRIOR AUTH FOR KYPHOP…” A third: “I have had cases submitted and waiting over 1 1/2 months for a UTN to be generated… patients are having to be cancelled for surgeries they need.” All three quotes are in the EFF Deeplinks post, which is the only primary source that has published them.
EFF also flags four candidate service expansions that would extend WISeR if cleared: air ambulance transport, cancer treatment, MRI scans, and medications without publicly available coverage criteria. Two of those - cancer care and emergency transport - are the kind of services where a denial or an 83-day wait can mean the difference between recovery and irreversible harm.
What This Means
The deeper privacy reading is not about a single vendor or a single denied procedure. It is about what happens when a federal program asks a private AI vendor to act as the gatekeeper for taxpayer-funded healthcare, the vendor ships before the software is finished, and the audit mechanism runs on a penalty the program structure makes cheap to absorb. The “AI with a human in the loop” promise is only as good as the human review can keep up; EFF’s records show the human step cannot, with one request sitting for 83 days. That is not a glitch. It is the system running as designed, slower than the FAQ promised.
There is also a question of consent that the EFF records leave open. None of the documents EFF has released describe what a Medicare beneficiary is told when their prior authorization is routed through an AI vendor. The WISeR FAQ frames the program as a coverage-neutral review, but the FOIA records pull no consent or notice template for patients. Beneficiaries of WISeR do not necessarily know an algorithm saw their case, and they do not get a choice.
The Bottom Line
WISeR is the largest federally run AI prior-authorization experiment in US history, and the FOIA records EFF released this month show that two of its six vendors launched with untested software, denied patients at scale, and responded to correction plans instead of pre-launch reviews. CMS told the public to expect 72-hour answers; the records show an 83-day wait is on the menu. Until those two failure modes are addressed, every prior authorization an Original Medicare beneficiary in those six states submits is a roll of the dice on which vendor got the contract.