Medicare quietly changed the rules. Did your biller notice?

What's changing

CMS has been steadily expanding prior authorization and pre-payment review within Traditional Medicare. The most visible step is the WISeR model, launched in 2026, which tests technology-assisted prior authorization for selected services across a group of pilot states — Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington. The details are deliberately fluid: which services, which review pathways, and which states are all subject to change as the pilot evolves.

The specifics matter less than the operational lesson: "Medicare doesn't require auth" is no longer a safe default. Before scheduling a service for a Traditional Medicare patient, the current requirement needs to be confirmed for that service, in that state, in that setting, for that date of service. Your Medicare Administrative Contractor's published guidance is the authoritative source — and someone in your revenue cycle needs to be reading it.

Meanwhile, the same pattern is playing out across commercial payers in reverse: many have reduced formal prior authorization while expanding post-service review. A service can show "no auth required" and still deny after the fact on medical necessity, diagnosis mismatch, or frequency edits. The pre-service green light answers one question. It doesn't answer whether you'll be paid.

The Medicare rules that were always strict — and often ignored

Two long-standing Medicare requirements deserve a fresh look, because they carry compliance weight rather than mere billing inconvenience.

Medicare Secondary Payer (MSP) screening. Medicare is not automatically primary. A working beneficiary (or working spouse) with qualifying employer coverage, care related to a workers' comp injury, care connected to an auto accident — in each case, another payer goes first, and providers are expected to ask the screening questions that surface these situations before billing Medicare. Billing Medicare first "because the patient is 70" is precisely the habit MSP rules exist to prevent. It generates denials on the good days and compliance exposure on the bad ones.

Qualified Medicare Beneficiary (QMB) status. Patients in the QMB program cannot be billed for Medicare deductibles, coinsurance, or copays — Medicaid handles that cost-sharing. Billing a QMB patient anyway isn't a clerical error; it's a federal violation. Identifying QMB status belongs in your verification workflow, checked before any Medicare cost-sharing is ever collected.

The question underneath all of this

Rules changing is normal. The real variable is whether anyone in your billing operation is tracking the changes — and whether you'd know if they weren't.

Here's an easy test. Ask your billing company three questions: What is our current process for checking Traditional Medicare authorization requirements before scheduling? How do we screen for MSP situations at registration? Where in our workflow is QMB status verified? Confident, specific answers mean you're covered. Hesitation means your Medicare billing is running on assumptions — and Medicare is the one payer where assumptions eventually become audit findings, recoupments, or worse.

A billing partner's job isn't just to process this month's claims under last year's rules. It's to see the rule changes coming and adjust your workflows before the denials arrive. That's the standard MD Billing works to: we track payer and CMS policy changes as part of the service, because a practice shouldn't learn about a pilot program from a remittance advice.

If you're not certain your Medicare workflows have kept up, that's exactly what our free revenue cycle assessment will tell you — including whether MSP and QMB gaps are sitting in your current process right now. Take the free revenue cycle assessment, or contact us for a direct conversation.