A missing answer is not a no

Between April 2023 and June 2024, states rechecked Medicaid eligibility for 94.3 million people. Nearly 21 million of them lost coverage. Of those terminations, 14.3 million were procedural, which is the official term for a case closed because the paperwork did not come back. The other 6.5 million were people a state actually determined to be ineligible.

That gap is what I want to write about. For roughly seven out of ten people who lost Medicaid, nobody decided they did not qualify. The record says the state did not hear back.

I want to be precise about what that number is and is not. It is not a count of people wrongly cut off. Some had moved, some aged into other coverage, some took a job with insurance, some did not want to renew. Procedural closure is not the same thing as error. But it is also not a determination, and the two get written to the same field, reported in the same total, and delivered to the same person as the same event. Coverage ended.

KFF states the risk plainly: procedural disenrollments happen when the state has outdated contact information, or when someone does not understand or does not return a renewal packet in time, and many people disenrolled this way may still be eligible (opens in a new tab). Their survey work supports the worry. Among adults who said they were disenrolled during the unwinding, 47 percent had re-enrolled in Medicaid by early 2024, and 70 percent went uninsured at least temporarily along the way. A system that closes a case and reopens it four months later did not make a decision about that person. It dropped one.

I have shipped this bug myself

I recognize this failure because I keep finding it in my own code.

plumbline (opens in a new tab) is a fail-closed audit harness I wrote to grade AI systems built for government use. A target returned 174 blank responses and scored a perfect 1.0000 on groundedness, privacy, representational harms, fairness, and cross-language behavior. The gate exited PASS. Every one of those checks is phrased as the absence of a bad thing, and silence contains no bad things. Silence passed.

Once I saw the shape, it was everywhere in my own repositories. ceqa-preflight (opens in a new tab) printed four PASS lines over a filing package whose PDFs had all timed out, byte for byte identical to the lines a clean package produces, and one of those four was the active-content check, so the report affirmatively cleared a document it had never opened. A weekly monitor in id-churn-sentinel (opens in a new tab) ran green for four consecutive weeks while its registry left zero of 152 sources eligible to check, because observing nothing emitted the same signal as observing no change. A judge-calibration statistic in fare-policy-assistant (opens in a new tab) reported perfect 1.000 agreement, because every label that recorded a disagreement had gone stale and the surviving sample was the agreeing half.

Each of those was green at the time. Each was a check that could not fail. The fix in every case was the same: split the absence of evidence away from the evidence of absence, and give the missing case its own name.

The reason I am writing about benefits systems rather than my own test harnesses is that the stakes are not comparable. When plumbline gets this wrong, a report is wrong. When an eligibility system gets it wrong, someone loses their health coverage and finds out at a pharmacy counter.

What the missing answer looks like in an eligibility system

In September 2023, CMS told states to stop (opens in a new tab). Thirty states had reported the same defect: their eligibility systems were running automatic renewals at the household level instead of the individual level, which federal rules require. The practical effect was that a household with one member who needed to submit something could have every member's coverage terminated, including children the state already held data showing were still eligible. CMS ordered those states to pause procedural disenrollments and reinstate the people affected. GAO later reported (opens in a new tab) that about 420,000 people across 29 states lost coverage this way and that all of them had been reinstated by January 2024.

Read that failure carefully, because it is not a policy failure and it is not a fraud failure. It is a data modeling failure. The system had the information it needed to renew those children. It asked the question at the wrong grain, got an incomplete answer for the household, and wrote that incompleteness into every individual record underneath. Nobody chose to disenroll 420,000 people. A join did.

The same shape shows up wherever verification meets a deadline:

• A verification lookup times out, and the case is recorded as failed verification rather than as verification not completed.
• A document upload fails silently on a phone, and the file is recorded as not provided.
• A notice goes to a stale address, and no response is recorded as no.
• An applicant misses a scheduled interview during a work shift, and the application is denied rather than parked.

This is not rare and it is not small. In one large southern state, among people who applied for food assistance online between September and December 2023, 21.1 percent of the control group were denied because caseworkers did not have enough information to decide whether they were eligible (opens in a new tab). One applicant in five got an answer that was not about them. The federal evaluation team that ran that study describes the category in the state's own words: failing to submit verification documents or complete the interview produces a denial due to incomplete information, rather than a denial due to ineligibility.

The interview version of this has a measured fix. A randomized field experiment with roughly 65,000 SNAP applicants in Los Angeles (opens in a new tab) found that letting applicants start their own interview when they were actually free, instead of requiring them to keep a scheduled appointment, raised approvals by more than six percentage points and doubled early approvals, from 14 percent to 27 percent by day five. Nothing about anyone's eligibility changed. What changed was whether the system could hear them. The authors put the general case plainly: many government program applications result in procedural denials caused by the burden of applying rather than by ineligibility.

The states that should exist

Here is the part I find genuinely encouraging. The government already models this correctly, in writing, in more than one program.

CMS's unwinding reporting template does not have a single bucket called "lost coverage." Metric 5b is the number determined ineligible. Metric 5c is the number terminated for procedural reasons, and the template glosses that phrase itself: failure to respond. Metric 5d is the number whose renewal was not completed. Those are different outcomes with different meanings, and the reporting requirement keeps them apart on purpose (opens in a new tab). The SNAP example is the same. A denial due to incomplete information and a denial due to ineligibility are separate categories in the state's own process.

The distinction is not something I am proposing. It exists in the regulation, in the reporting template, and in the caseworker's vocabulary. It gets lost between there and the database.

Which means the design rule is not novel and does not require anyone to change policy. It requires the software to preserve a difference the policy already draws. At minimum an application or renewal system should be able to represent, and act differently on:

• Not asked. The question never applied to this person, or the flow never reached it.
• Not answered. The question was asked and nothing came back. This is the state that gets destroyed most often.
• Answered, and the answer is no. A person or a caseworker asserted something.
• Could not verify. The system tried to check and could not, because a service was down, a match failed, or a document could not be read. This is not the applicant's answer at all. It is the system's.
• Not applicable. Structurally irrelevant, and different from all of the above.

Collapse those five into a boolean and you have built a machine that cannot tell the difference between a person who does not qualify and a person it failed to reach. Keep them apart and several things become possible that were not possible before. The system can route a could-not-verify to a retry or a caseworker instead of to a denial. It can tell an applicant which specific thing is missing rather than that their application is incomplete. It can report procedural closures separately from eligibility denials, so an agency can see the burden its own process is generating instead of reading it as a caseload of ineligible people. And it can fail loudly toward the agency while failing gently toward the resident, which is the correct direction for both.

The ex parte numbers show how much room there is. Of the people whose Medicaid coverage was renewed during the unwinding, 61 percent were renewed automatically from data the state already had, without the enrollee doing anything. That rate was above 90 percent in Arizona, North Carolina, and Rhode Island, and 11 percent or less in Pennsylvania and Texas. Same federal rules, same available data sources, and at least an eightfold difference in how often the state answers its own question instead of mailing it to a family. Automation is not the thing that hurts people here. Asking people for information the government already holds is.

What I do now

I have a rule in the projects that publish measurements about real institutions, and it survives contact with production because it is boring: a value that was not measured never renders as a measured value.

In afterward (opens in a new tab), which joins California training programs to state occupational projections, suppressed and unreported outcomes never render as zero, and coverage is a published output rather than a footnote. In disclosed (opens in a new tab), which grades colleges on what they disclose rather than on how they perform, every published value is classified as reported, implausible, suppressed, not applicable, or missing, because a suppressed measure and a zero are different facts that most tools render identically. In GTFS Scorecard, a feed my fetcher could not reach is scored "not measured," which is a first-class outcome distinct from passing, and a test fails the build if a silent target ever scores as clean again.

None of that is clever. It is the same rule five times: keep the missing case separate, name it in the schema, and make the interface show it.

I learned the beginning of this a decade ago in California state government, building the public Home Care Aide Registry and the renewal and ongoing-service workflows behind it. Every registry with a renewal has to answer the same question CMS was asking states in 2023: what does the system do when the renewal does not come back? That is a design decision. Somebody makes it, usually early, usually in a hurry, and usually without writing down that they made it. It then executes on everyone, forever, at whatever scale the program reaches.

The obligation

I keep returning to a sentence from my last essay about grading public data: every number needs a denominator, and every status needs a meaning. In a benefits system the status is a person's coverage, and the meaning had better be the one the agency intended.

Fourteen point three million procedural terminations is not fourteen point three million wrong answers. It is fourteen point three million cases where the software recorded an outcome that no human being determined. Some of those were correct. The system cannot tell you which, and that is the defect.

A public benefits system should be able to say "we do not know yet" out loud, to the applicant and to the agency, for as long as that remains true. The front door to a public program should never be able to say no by accident.