What changed
FACT: On 2026-06-03 CMS published an Interim Final Rule (with a technical correction 2026-06-29) implementing the Medicaid community-engagement (work) requirement under SSA §1902(xx). It compels states to verify qualifying activities/exemptions for certain able-bodied adult enrollees and file new compliance reports to CMS.
Why now
FACT: Hard statutory deadline — states must implement no later than 2027-01-01 (~18 months of build/procure runway from the rule date). INFERENCE: This is the same reconciliation-law work-requirement wave KFF is tracking across states; nearly every state is being forced to stand up verification/reporting infrastructure on the same clock.
Converging signals
Three signals meet: (1) the federal rule, (2) a defined forced class (able-bodied adult Medicaid enrollees who must document activity/exemption + the states/MCOs/counties who must verify), and (3) new CMS reporting portals that cascade to 50 state eligibility systems. Multiple corroborating items (Holland & Knight, HME Business, VitalLaw, KFF) confirm the mandate is live, not proposed.
Customer pain
HYPOTHESIS (well-supported): States and their county/MCO/contractor administrators must build outreach, activity verification, noncompliance tracking, and new CMS reports on a short clock, and prior state work-requirement rollouts (Arkansas 2018) were operationally chaotic and litigated. FACT of burden: an industry group publicly called the rule 'Unnecessary and Very Burdensome.' The unglamorous, replicable pain is exemption/activity documentation at the point of contact.
Who pays
NOT the beneficiaries (they are low-income and cannot pay per-seat — this is the core weakness of side 1). Realistic payers: MCOs (managed-care orgs paid capitation and penalized for churn/redeterminations), county human-services offices, community-based navigator/enrollment orgs, and workforce/staffing programs that already log participant hours. Possibly state agencies directly, but that is procurement-gated.
Solved today
Today: manual case-management, existing state eligibility vendors (Gainwell, Conduent, Deloitte, Maximus), spreadsheets, and paper exemption attestations. The Arkansas precedent was a clunky online-only portal that caused mass improper disenrollment.
Why current solutions are bad
Incumbent eligibility-system vendors are slow, expensive, and focused on the state's system of record — not on the front-line documentation UX for navigators and beneficiaries. Manual attestation loses paperwork and triggers wrongful disenrollment (litigation risk for the state). Gap: a lightweight, mobile-first activity/exemption capture tool that feeds clean data upstream.
Proposed product
A narrow, HIPAA-compliant white-label web/mobile tool: beneficiary or navigator logs qualifying activities (work hours, volunteering, school, caregiving) and captures exemption evidence (disability, pregnancy, caregiver, SUD treatment) with document upload, generates an audit-ready compliance packet, and exports/API-pushes to the state eligibility or MCO system. Sold to the intermediary, not the beneficiary.
MVP version
A single-state exemption-documentation + activity-log web app with document upload, an exemption-eligibility questionnaire mapped to the rule's exception/exclusion criteria, and a clean exportable PDF/CSV packet. Pilot with ONE MCO or county navigator org. No direct state-system integration in v1 — export files a caseworker uploads.
30-day build
Read the IFC in full and build the exemption/exclusion decision tree from its stated criteria. Interview 5-10 MCO care-management leads and county navigator orgs to confirm who owns this workflow and the willingness to pay. Pick one target state (ideally an early-implementer). Stand up a HIPAA-ready stack (BAA-capable hosting, encrypted storage) and prototype the questionnaire + upload.
60-day build
Ship the MVP to one design-partner MCO/navigator org. Nail the exemption decision tree and audit-packet output against the actual rule text. Get a signed BAA and a paid pilot. Draft the state-system export format for that state.
90-day revenue plan
Convert the pilot to a paid per-seat/per-active-beneficiary subscription with the design-partner org; use its logo + a compliance-readiness demo to sell 2-3 more MCO/county buyers in the same state, then template for a second state. Realistic first revenue is a pilot contract, not self-serve volume.
Distribution path
Direct outreach to MCO care-management and county human-services leaders; partner with enrollment/navigator nonprofits (they touch beneficiaries and are grant-funded to do exactly this outreach); publish a free 'Medicaid work-requirement exemption checklist' as an inbound demand magnet. Demonstrated-value selling, but the buyer is an organization — expect a 1-3 month sales cycle, not instant self-serve.
Pricing hypothesis
Per-active-beneficiary/month (e.g., $1-3) to MCOs/counties, or a flat per-seat SaaS for navigator caseworkers ($30-80/seat/mo), plus optional per-report/setup fee for state-export configuration.
Technical difficulty
Moderate. The app itself is simple CRUD + document upload + a rules-based questionnaire — trivial for AI-assisted build. The hard parts are HIPAA/PHI handling (BAAs, encryption, access controls) and each state's export/integration format, which multiply per state.
Legal / regulatory risk
REAL and non-trivial: this touches Medicaid eligibility data = PHI. Founder must become a HIPAA business associate, sign BAAs, and get security right — this is a genuine heavy_compliance barrier, not a moat he gets for free. The IFC is also an interim rule open to comment and litigation; scope could shift. Not a portal-submission tool with zero platform owner — it's regulated health data.
Platform dependency
Low platform-policy risk (no app-store gatekeeper who can deplatform). Dependency instead on state eligibility-system export formats and MCO data agreements.
Founder fit
MIXED. Strong on the forced-buyer/compliance-tooling shape he excels at, and public-records/operational-workflow instincts apply. BUT this diverges from his proven ELDT pattern in two costly ways: (1) the numerous filer (beneficiary) cannot pay, so revenue depends on selling to MCOs/counties = organizational/quasi-enterprise buyers, and (2) PHI/HIPAA is heavier compliance than a public FMCSA portal upload. Fit is real but not maximal — 6, not 9.
Breakout potential
High ceiling IF he lands one MCO and templates across states — 50 near-identical markets on one deadline. But incumbents (Gainwell/Deloitte/Maximus) will chase the state contracts, so the durable wedge is the front-line navigator/MCO layer they under-serve, not the state system of record.
Final recommendation
QUALIFIED PURSUE — but only the narrow intermediary wedge. Do NOT build the beneficiary-pays consumer app (no payer) and do NOT chase direct state procurement (enterprise-gated). Validate in 30 days that MCOs/county navigator orgs will pay for a HIPAA-compliant exemption-documentation + activity-log tool; if 5-10 interviews don't surface a willing organizational buyer and a viable BAA path, kill it. The mandate and deadline are ironclad demand; the risk is entirely on the payer/channel and HIPAA burden.
Next action
Read the IFC (2026-11094) in full, extract the exemption/exclusion decision tree, and cold-outreach 8 MCO care-management + county navigator leaders in one early-implementer state to test willingness to pay before writing product code.