Federal health programs increasingly depend on digital identity, authentication, remote identity proofing, broker access controls, third-party platform oversight, and audit-ready compliance systems. The National Institute of Standards and Technology, or NIST, is the government agency in charge of defining technical standards, and many industry best practices.

Because of the gravity of these programs, technical standards are no longer just “IT references.” They are part of the operating structure of the Marketplace.

Cybersecurity, PII, and FWA are all reasons why the Marketplaces continued reference to the NIST Special Publication (SP) 800-63-3 in Center for Consumer Information and Insurance Oversight (CCIIO) guidance deserves attention.

NIST withdrew SP 800-63-3 and superseded it with SP 800-63-4 as of August 1, 2025 ( according to NIST’s Computer Security Resource Center, or CSRC, page)

Yet CCIIO’s Year 9 Enhanced Direct Enrollment audit guidance, issued April 10th, 2026, continues to reference NIST 800-63-3 in several operationally important places, including identity proofing, Identity Assurance Level 2 (IAL2)/Authentication Assurance Level 2 (AAL2) requirements, and multi-factor authentication (MFA) for agents and brokers. The guidance says third-party identity proofing services must be compliant with NIST 800-63-3 IAL2/AAL2 requirements, and it separately requires Enhanced Direct Enrollment (EDE) entities to implement MFA for agents and brokers consistent with NIST SP 800-63-3. That may sound like a technical citation issue… It is not.

In Marketplace operations, technical standards become compliance infrastructure. They shape identity proofing, multi-factor authentication, broker access, audit evidence, platform design, vendor controls, compliance investments, and enforcement expectations.

They also shape the government’s ability to prevent, detect, and respond to fraud, waste, and abuse.

The Citation Problem Is Really an Oversight Problem

The issue is not just “800-63-3 is old”, and “SP 800-63-4 is not a clerical update”.

NIST describes Revision 4 as a substantial update and reorganization of 800-63-3. The updated framework expands security, privacy, and customer experience considerations, updates digital identity models, expands digital identity risk management, adds performance metrics for continuous evaluation, adds redress requirements, and adds a new subsection addressing artificial intelligence (AI) and machine learning (ML) in digital identity services.

NIST’s SP 800-63-4 landing page also identifies several major changes which matter directly to Marketplace security and program integrity: updated risk management context, recommended continuous evaluation metrics, expanded fraud requirements for identity proofing, controls for injection attacks and forged media such as deepfakes, and integration of syncable authenticators such as synced passkeys.

Those are not abstract updates. They map directly to the modern threat environment facing Marketplace enrollment. Fraud, waste, and abuse does not stand still.

Bad actors adapt. Phishing gets better. Account takeover becomes more sophisticated. AI-enabled identity fraud becomes easier to scale. Vendor ecosystems become more complex. Broker access points become higher-value targets.

So when CCIIO continues to anchor EDE audit expectations to a retired digital identity standard, it raises a larger oversight question:

Is Marketplace oversight keeping pace with the risks it is supposed to monitor?

The Threat Environment Changed, and the Standard Changed With It

One of the most important changes in SP 800-63-4 is the shift toward a more explicit digital identity risk management framework.

NIST says digital identity risk management is used to assess risks associated with online services, including risks to users, service providers, mission partners, and business partners. It also emphasizes selecting usable, privacy-enhancing, security and anti-fraud controls, then continuously evaluating whether those controls are working. Digital identity risk management is crucial for EDE platforms because identity proofing and authentication are not one-time check-the-box exercises. They are operating controls.

If an EDE entity, web-broker, issuer, or downstream platform is using a third-party identity vendor, authentication provider, or federated identity service, the question should not only be whether the vendor once attested to a standard.

The questions should include:

• Can the entity show how the identity controls perform over time?

• Can it detect account takeover attempts?

• Can it identify fraudulent proofing patterns?

• Can it see whether certain proofing methods generate higher failure, abandonment, or fraud rates?

• Can it coordinate security, fraud, identity, and compliance data across vendors and relying parties?

SP 800-63-4 is much more explicit with their governing framework. NIST says organizations must implement a continuous evaluation and improvement program using end-user input and performance metrics, and must monitor the evolving threat landscape and regularly assess security measures and fraud detection capabilities against current fraud tactics… A significant difference from treating identity proofing and MFA as static audit artifacts.

Identity Controls Should Be Measured, Not Just Documented

SP 800-63-4 identifies performance metrics organizations should track as part of continuous evaluation.

Those metrics include pass rates, fail rates, abandonment rates, authentication failures, account recovery attempts, confirmed unauthorized access or fraud, suspected unauthorized access or fraud, reported unauthorized access or fraud, unauthorized access or fraud by proofing type, unauthorized access or fraud by authentication type, help desk calls, redress requests, and redress resolution times.

Tracking metrics is critical, because modern fraud oversight depends on feedback loops. If CMS/CCIIO is serious about Marketplace program integrity, the oversight model should ask not only whether EDE entities have identity proofing and MFA. It should ask whether those controls are actually working.

For example:

• Are certain broker access pathways producing more account recovery events?

• Are certain authentication methods associated with more unauthorized access reports?

• Are downstream or upstream EDE arrangements producing different fraud or failure patterns?

• Are identity proofing failures concentrated in certain workflows?

• Are legitimate users getting blocked while bad actors find workarounds?

These are operational questions. They are also FWA questions.

A Marketplace oversight framework not keeping pace with modern identity metrics risks is moreso a paperwork exercise rather than a program integrity system.

MFA Is No Longer Enough If It Can Be Phished

For authentication, SP 800-63B-4 places more explicit emphasis on phishing resistance.

At Authentication Assurance Level 2 (AAL2), NIST says verifiers must offer at least one phishing-resistant authentication option. It also says federal agencies must require staff, contractors, and partners to use phishing-resistant authentication to access federal information systems, and should encourage phishing-resistant authentication at AAL2 whenever practical because phishing is a significant threat vector.

At Authentication Assurance Level 3 (AAL3), NIST goes further. AAL3 requires a cryptographic authenticator with a non-exportable private key that provides phishing resistance. NIST also states syncable authenticators cannot be used at AAL3 because they require the private key to be exportable.

Keeping pace with modern authentication methods is necessary for Marketplace oversight because agent and broker accounts are not ordinary accounts. They can be gateways into consumer enrollment workflows, eligibility information, plan selection activity, and downstream platform access.

If CCIIO’s audit guidance continues to reference 800-63-3, regulated entities may reasonably ask whether the current audit expectation is still tied to older MFA models, or whether CCIIO expects alignment with the current NIST direction toward phishing-resistant authentication.

That is not a small implementation question. It affects vendor selection, authentication roadmaps, EDE platform design, downstream broker access, audit evidence, and enforcement expectations.

Passkeys Are Here, But the Rules Need to Catch Up

SP 800-63-4 also integrates syncable authenticators, including synced passkeys, into the framework.

NIST explains how properly configured syncable authenticators can provide phishing resistance because they create a unique public or private key pair constrained to the specific website or relying party, which prevents a fake website from capturing and reusing an authenticator output. NIST also states where syncable authenticators can provide replay resistance and authentication intent.

The updated standards reflect how the authentication market has changed since 2017. Passkeys, platform authenticators, and phishing-resistant authentication options are now part of the modern identity environment.

But there are important compliance distinctions. A syncable authenticator may be useful in many settings, while still not satisfying AAL3 because AAL3 requires a non-exportable private key: an important nuance.

If CCIIO guidance points entities back to 800-63-3 without clarifying the status of 800-63-4, EDE entities and auditors are left to interpret how current authentication technologies fit into a Marketplace compliance framework which is still citing a retired standard.

AI Has Moved Identity Fraud Into a New Era

The AI issue is one of the clearest reasons guidance to use an old standard is not just a citation problem.

1. SP 800-63-3 was developed before today’s AI identity-fraud environment fully emerged.

2. SP 800-63-4 directly addresses artificial intelligence and machine learning in identity systems.

NIST says identity solutions may use AI and machine learning to improve biometric matching, automate evidence or attribute validation, detect fraud, and assist users through tools such as chatbots. But NIST also warns these technologies may introduce new risks or produce unintended negative outcomes.

SP 800-63-4 then sets requirements for AI and machine learning use in identity systems.

NIST says all uses of AI/ML must be documented and communicated to organizations who rely on those systems. It also requires disclosure of integrated AI/ML technologies used by credential service providers, identity providers, or verifiers to relying parties making access decisions based on those systems.

NIST further says organizations using AI/ML must provide information about model training methods, training datasets, model update frequency, and algorithm testing results. It also says organizations using or relying on AI/ML systems should implement the NIST AI Risk Management Framework, and must perform and document privacy risk assessments for personal information and data processed by those systems. Implementing the framework is a major operational change. In plain terms, 800-63-4 moves AI in identity systems from “vendor feature” to auditable control environment.

EDE’s need to adapt because identity proofing vendors, authentication vendors, fraud vendors, document validation vendors, biometric tools, and support systems may increasingly rely on AI-enabled functions.

If those tools are used to approve, reject, escalate, flag, verify, or support Marketplace access decisions, then Centers for Medicare & Medicaid Services (CMS) and CCIIO’s oversight framework must account for how those AI systems are governed.

• Who knows where AI is used?

• Who receives disclosures?

• What datasets were used?

• How often are models updated?

• What testing was performed?

• How are false positives and false negatives monitored?

• How are privacy risks assessed?

• How are consumers, brokers, and assisters protected from erroneous or opaque identity decisions?

These are not future questions. They are current oversight questions.

Deepfakes Turn Remote Identity Proofing Into a Front-Line Risk

SP 800-63-4 also updates identity proofing for a world where remote proofing can be attacked with generative AI, forged media, and digital injection techniques.

NIST’s SP 800-63A-4 includes a section on digital injection prevention and forged media detection. It states how emerging attacks on remote identity proofing increasingly combine digital injection attacks with generative AI tools used to create or modify images or videos of applicants and evidence, including deepfakes, to defeat document validation, biometric operations, and visual comparisons by proofing agents.

NIST explains injection attacks insert modified or forged media between the capture point, such as a device, and the system or person performing the comparison. It also says all types of remote identity proofing are vulnerable in some way to these attacks, including remote optical capture, automated biometric mechanisms, and video systems used in remote attended processes.

SP 800-63A-4 then sets specific expectations for remote proofing processes which use optical capture, recognition tools, remote biometric capture, or video sessions.

Among other things, NIST says credential service providers must implement technical controls to increase confidence that digital media is being produced by a genuine sensor, analyze submitted digital media for indicators of modification, manipulation, tampering, or forgery, test automated image analysis algorithms against forged and genuine media, use authenticated protected channels, and document tested attack artifacts and false negative rates for relying parties upon request.

NIST also says providers need to analyze digital media for signatures of generative AI algorithms and deepfake tools, and in remote attended scenarios, proofing agents and trusted referees must be trained to identify manipulated media indicators such as latency, synchronization issues, and inconsistent skin tone or resolution. Monitoring for tampered content is critical, as it ties directly to Marketplace fraud prevention.

Remote identity proofing is no longer simply a question of whether someone can upload a document or answer verification questions. The question is whether identity proofing workflows can withstand synthetic identity attempts, forged evidence, manipulated video, emulator-based attacks, virtual camera attacks, and AI-generated media.

If CCIIO guidance continues to reference the retired 800-63-3 framework, it should clarify how it’s own systems, as well as EDE entities and auditors are expected to account for the newer 800-63-4 controls addressing these risks.

Fraud Signals Are Only Useful If the System Can See Them

One of the most important additions in 800-63-4 is the connection between identity systems and program integrity.

NIST says close coordination among identity functions, cybersecurity, privacy, threat intelligence, fraud detection, and program integrity enables better protection of business capabilities and continuous improvement. NIST gives an example where payment fraud data collected by program integrity teams could reveal compromised subscriber accounts or weaknesses in identity proofing implementations.

NIST also says organizations must establish consistent mechanisms for exchanging information among stakeholders responsible for critical internal security and fraud prevention. For external stakeholders and identity services, NIST says organizations should do the same, and when external identity providers are involved, consider information-sharing mechanisms in contractual and legal mechanisms.

Data interoperability is highly relevant to the Marketplace, since EDE is not a single-system environment. It involves CMS, issuers, web-brokers, EDE entities, upstream EDE entities, downstream agents and brokers, authentication systems, identity proofing vendors, APIs, audit firms, and consumer-facing enrollment workflows. As a result, program integrity cannot depend only on isolated annual attestations. It requires coordinated visibility.

If fraud signals sit in one system, authentication signals sit in another, broker behavior sits in another, and consumer complaints sit somewhere else, then the oversight model can miss patterns which only become visible when the pieces are connected. Exactly why version alignment matters.

800-63-4 better reflects the modern reality: identity, fraud, cybersecurity, privacy, and platform governance are intertwined.

The Marketplace Fraud Waste and Abuse (FWA) concern.

The concern is not CCIIO is ignoring security.

The Year 9 EDE audit framework includes extensive privacy, security, and audit requirements. It also relies heavily on NIST SP 800-53 Rev. 5 and formal audit methodologies.

The concern is CCIIO’s digital identity references may be lagging the current best-practice standard at the same time the Marketplace is facing increasingly complex FWA risks: an important distinction.

The goal is not to criticize CMS or CCIIO for the sake of criticism. It is about whether the oversight framework is keeping pace with the threat environment.

Marketplace fraud, waste, and abuse can emerge through many pathways:

• Unauthorized broker account access.

• Weak or outdated MFA.

• Poor downstream access controls.

• Remote identity proofing failures.

• Synthetic identity attempts.

• AI-enabled document or biometric manipulation.

• Poor vendor transparency.

• Inadequate audit evidence.

• Disconnected fraud, security, and program integrity data.

• Insufficient feedback loops between consumer complaints, broker activity, issuer reporting, and platform-level risk signals.

The move from 800-63-3 to 800-63-4 is relevant because the updated standard speaks directly to many of these issues. It addresses:

• Phishing-resistant authentication.

• Continuous evaluation.

• Fraud metrics.

• AI and machine learning in identity systems.

• Forged media and deepfakes.

• Vendor disclosure and relying-party visibility.

• Privacy risk assessments.

• Redress and human support.

• The need for coordination among identity, cybersecurity, fraud, and program integrity teams.

Those are not peripheral issues. They are central to whether Marketplace oversight can keep up with modern FWA risk.

The Compliance Problem for EDE Entities and Auditors

When CMS or CCIIO guidance references a retired NIST standard, EDE entities, web-brokers, issuers, auditors, and vendors are left with a practical question:

Should they…

• comply with the retired standard which is expressly cited?

• comply with the current NIST standard?

• treat 800-63-4 as acceptable or preferred if it meets or exceeds the older standard?

• wait for CMS or CCIIO to issue updated guidance?

Navigating these standards is not a theoretical issue… Enhanced Direct Enrollment entities, web-brokers, issuers, auditors, and downstream broker platforms are being asked to document identity proofing, authentication, multi-factor authentication, and security controls in a highly regulated environment.

The CCIIO guidance requires documentary evidence, auditor review, and verification tied to these processes. It also applies across complex arrangements involving primary EDE entities, upstream EDE entities, downstream agents and brokers, identity proofing services, and MFA implementation.

When a federal program references a cybersecurity standard, that reference shapes procurement, vendor design, audit evidence, compliance investments, legal interpretation, and enforcement expectations.

If the standard has changed, the guidance must be updated or clarified.

What CCIIO Needs to Clarify Now

At minimum, CCIIO should clarify whether EDE entities and auditors are expected to:

• Follow NIST SP 800-63-3 because the version is expressly cited in current EDE guidance.

• Follow NIST SP 800-63-4 because it is the current NIST digital identity standard.

• Treat SP 800-63-4 as acceptable or preferred if it meets or exceeds the older requirements.

• Apply SP 800-63-4 only to new implementations, vendor changes, or future audit periods.

• Or wait for future CMS guidance before changing implementation or audit documentation.

Also, clarify whether its EDE audit expectations now account for the major security provisions in SP 800-63-4, including:

• Phishing-resistant authentication at AAL2.

• AAL3 requirements for non-exportable private keys and phishing resistance.

• Appropriate treatment of syncable authenticators and passkeys.

• Continuous evaluation metrics for identity systems.

• Fraud metrics tied to identity proofing and authentication.

• AI/ML documentation, disclosure, testing, and privacy risk assessment requirements.

• Digital injection prevention.

• Forged media and deepfake detection.

• Vendor disclosure obligations.

• Information sharing among cybersecurity, fraud, identity, and program integrity functions.

• Redress, human support, and issue-handling processes for legitimate users affected by identity system failures.

These are not simply technical preferences. They are the building blocks of modern Marketplace trust.

Why Addressing the CCIIO Adopted Security Standard Matters for Marketplace Trust

Healthcare policy increasingly runs through software. Software increasingly runs through identity, authentication, access controls, audit trails, and trust frameworks… and trust frameworks only work when the rules are current, clear, and operationally aligned.

The Marketplace does not need ambiguity at the intersection of consumer data, broker access, issuer systems, EDE platforms, identity vendors, and federal oversight.

It needs a clear answer: For EDE and Marketplace platform oversight, is the governing digital identity standard now NIST SP 800-63-4? If not, why not?

And if CMS/CCIIO is serious about strengthening Marketplace fraud, waste, and abuse oversight, why would current guidance continue to rely on a retired digital identity standard when the updated NIST framework addresses the very risks now facing the system?

The answer is critical because the advising auditors to use 800-63-3 is bigger than one citation, or documented mishap. It is another example of the broader challenge facing Marketplace oversight: the operational environment evolves quickly, but federal guidance often moves slowly.

When regulators lag best practices, gaps in the system have real consequences.

And, when technical guidance falls behind current security standards, regulated entities face uncertainty, auditors face inconsistent expectations, vendors face unclear implementation targets, and consumers remain dependent on oversight systems who may not fully reflect the current threat landscape.

CCIIO should update or clarify its guidance.

The Marketplace needs rules that are current, enforceable, and aligned with modern digital identity risk. Using a retired cyber security standard is not just a cybersecurity issue… It is a program integrity issue.

About Pegasus Health Institute

Pegasus Health Institute is a nonpartisan nonprofit think tank focused on health policy, market structure, public program design, and the financing systems that shape access to care. Pegasus analyzes federal and State health policy through a practical implementation lens, translating complex regulatory and fiscal issues into clear insights for policymakers, industry stakeholders, and the public.

About the Author

Joshua Brooker, REBC®, ABHP, ASFC, is a health policy strategist, benefits professional, and founder of Pegasus Health Institute. He has worked at the intersection of ACA policy, individual market enrollment, ICHRA strategy, broker operations, and health finance since the early implementation of the Affordable Care Act. Joshua has engaged with CMS, CCIIO, IRS, OMB, State-based Marketplaces, and members of Congress on health policy issues, and his work has been cited in national media including The Wall Street Journal, Associated Press, NPR, KFF Health News, and U.S. News. His analysis focuses on how policy decisions affect consumers, markets, public programs, and the professionals responsible for making the system work in practice.

Executive Takeaways

The 2027 Notice of Benefit and Payment Parameters (NBPP) final rule gives States more authority in some areas, but it also creates new oversight, fiscal, and operational responsibilities.

State Exchanges and State regulators gain or retain meaningful flexibility around Exchange transitions, network adequacy review, Essential Community Provider (ECP) review, and non-network qualified health plan (QHP) implementation. But they also face new responsibilities around State-required benefits, Essential Health Benefit (EHB) defrayal, improper payment measurement, eligibility verification, and public program coordination.

Public program teams, including Basic Health Program (BHP) and Medicaid agencies, must also prepare for noncitizen eligibility changes that affect Marketplace subsidy eligibility, BHP payment calculations, and transitions between coverage programs.

The practical result is a rule that gives States more discretion, but not less work.

In the public comments we helped develop during the rulemaking process, we repeatedly emphasized the same core point: State flexibility only works if States have enough time, infrastructure, legal authority, fiscal planning, and operational capacity to implement that flexibility responsibly.

This State-focused analysis is part of a broader stakeholder series. Related articles address issuers, agents and brokers, and consumers and enroller implementation priorities.

The State Question: What Actually Changes?

The 2027 NBPP final rule affects States in several different roles…

Read more

Executive Takeaways

The 2027 Marketplace rule (known as the Notice of Benefit and Payment Parameters or NBPP) will affect consumers in two big ways:

First, there may be more types of health plans to compare.

Second, consumers may have to provide more paperwork to prove they qualify for financial help or special enrollment.

The Centers for Medicare & Medicaid Services, or CMS, finalized several changes that may affect the health plans people see when shopping through the Marketplace. Some plans may have different deductibles, copays, provider access rules, and maximum out-of-pocket costs. Some lower-premium options may become available, but lower premium does not always mean better coverage.

At the same time, consumers who receive financial help, often called premium tax credits, will need to pay closer attention to tax filing, income documentation, and enrollment deadlines.

For consumers, the main takeaway is this:

The Marketplace may offer more choices, but those choices may be harder to understand.

For brokers, and consumer support organizations, the work becomes more important. Consumers will need help understanding not just monthly premiums, but also doctors, medications, deductibles, prior authorization, paperwork requirements, and what happens when they actually need care.

This consumer-focused article is part of a broader stakeholder series. Other articles cover issuers, agents and brokers, State Exchanges and regulators, and public program teams implementation issues.

What Actually Changes for Consumers?

Most consumers do not experience federal health policy as a regulation.

They experience it as:

Read more

Executive Takeaways

The 2027 Notice of Benefit and Payment Parameters (NBPP) final rule increases compliance responsibility for agents, brokers, web-brokers, and Enhanced Direct Enrollment (EDE) partners.

The Centers for Medicare & Medicaid Services (CMS) finalized a standardized U.S. Department of Health and Human Services (HHS)-approved consumer consent form requirement for plan years beginning on or after January 1, 2028. CMS also finalized more explicit marketing standards, removed the federal vendor training pathway in favor of Marketplace Learning Management System (MLMS)-only certification, tightened several eligibility verification and documentation rules, and continued moving the Marketplace toward a more structured compliance environment.

At the same time, the final rule removes standardized plan option requirements and non-standardized plan limits. That change gives issuers more product design flexibility, but it also means brokers and enrollment partners will need to do more work to interpret, compare, and explain the market.

The practical result is simple: more documentation, more oversight risk, and more value in professional guidance.

Many of the broker-facing issues addressed in the final rule were also raised in comments we helped draft during the rulemaking process. Those comments emphasized a consistent theme: protecting consumers requires more than static documentation. It requires system-based controls, clear authorization workflows, better platform security, practical verification tools, and enforcement focused on the actors and infrastructure most capable of creating large-scale harm.

This broker-focused analysis is part of a broader stakeholder series. Related articles address issuers, consumers, State Exchanges and regulators, and public program teams implementation priorities.

The Broker Question: What Actually Changes?

For agents, brokers, web-brokers, and EDE partners, the 2027 NBPP final rule is not

Read more

Executive Takeaways

The 2027 Notice of Benefit and Payment Parameters (NBPP) final rule gives issuers more product design flexibility, but it does not make the Marketplace simpler to operate.

CMS finalized the elimination of federal standardized plan option requirements and non-standardized plan limits beginning in PY2027. That gives issuers more room to design products around local market realities, network strategy, actuarial assumptions, and consumer demand.

CMS also finalized new CSR loading documentation requirements, tighter State-required benefit and EHB defrayal rules, bronze maximum out-of-pocket flexibility, multi-year catastrophic plans, a non-network QHP certification pathway, QIS flexibility, and several audit and enforcement provisions.

The practical result is more flexibility, more product strategy opportunity, and more documentation risk.

Issuers should not treat the final rule as a simple deregulation package. CMS is removing some federal product design constraints, but it is also asking for more justification, more operational support, more auditability, and clearer evidence that issuer practices match regulatory requirements.

This issuer-focused analysis is part of a broader stakeholder series. Related articles will address agents and brokers, consumers and assisters, State Exchanges and regulators, and public program administrators implementation priorities.

The Issuer Question: What Actually Changes?

The 2027 NBPP final rule affects issuers across product design, pricing, filing strategy, certification, compliance, consumer support, and operational governance.

The most visible changes involve plan design flexibility. CMS is removing standardized plan option requirements and non-standardized plan limits. It is creating more room for bronze plan variation. It is allowing multi-year catastrophic plans. It is finalizing a non-network QHP pathway.

But the less visible changes may be just as important.

CSR loading documentation becomes more formal. State-required benefit and EHB defrayal analysis becomes more important. Non-network QHPs create new operational and benchmark pricing questions. Risk adjustment, HHS-RADV, QIS, audits, and CMP authority all reinforce the same theme: issuer flexibility will need to be supported by a clear administrative record.

The practical question for issuers is not only, “What can we file?”

Read more

Welcome to Pegasus Health Institute.

Pegasus was created to study one of the most important and underexamined questions in American healthcare:

Why does the system keep producing higher costs, more complexity, and uneven affordability even after decades of reform?

Healthcare affordability remains one of the most pressing challenges facing families, employers, and policymakers. Costs continue to place pressure on household budgets, business decisions, and public programs.

Yet much of the national debate still focuses on coverage expansion, regulatory mandates, or competing ideological models of what the healthcare system should be.

Those debates matter.

But they often miss something deeper: the structural incentives embedded inside healthcare markets.

• Payment systems.

• Subsidy structures.

• Regulatory frameworks.

• Provider reimbursement models.

• Care delivery operations.

• Insurance market design.

• Administrative infrastructure.

• Revenue cycle management.

• Data exchange.

• Claims, eligibility, and billing workflows.

• Vertical integration.

• Consumer cost exposure.

These are the mechanics that determine how healthcare is priced, delivered, financed, and experienced in real life.

That is where Pegasus begins.

Why Pegasus exists

Pegasus Health Institute is a nonpartisan institute of Helping Health, Inc., a 501(c)(3), focused on the mechanics of healthcare markets and the structural incentives that shape healthcare affordability, access, and system performance.

Helping Health began during the COVID-19 pandemic to help families navigate Medicaid and CHIP eligibility during a period of major employment and coverage disruption.

Through that work, a broader reality became clear: many of the challenges consumers face are not simply enrollment problems or coverage problems. They are downstream effects of deeper structural incentives built into the healthcare system itself.

Pegasus represents the next step in that mission.

Instead of focusing only on helping people navigate the system as it exists today, Pegasus moves upstream to study the policy and market forces that shape the system in the first place.

Our mission

The mission of Pegasus Health Institute is to identify, analyze, and propose solutions for structural incentives within healthcare markets that contribute to rising costs, inefficiencies, and misaligned policy outcomes.

That means our work will focus on three things:

Evidence-driven analysis.
We want to understand what is actually happening inside healthcare markets.

Practical policy solutions.
We are interested in ideas that can work in the real world, not just in theory.

Constructive engagement.
We aim to serve policymakers, industry stakeholders, employers, advisors, innovators, and the public with clear analysis that improves understanding and supports better decision-making.

Pegasus is nonpartisan by design. We are focused on solutions rather than ideology.

Our lens: top down and bottom up

Healthcare finance is often studied from the top down.

• Federal spending.

• Budget projections.

• Public programs.

• Regulation.

• Subsidies.

• Mandates.

• Tax policy.

That perspective is essential, but incomplete.

The system also has to be understood from the bottom up.

• What does a family experience when income changes?

• What does an employer experience when premiums rise again?

• What does an advisor, broker, or benefits professional see when coverage rules shift?

• What does a provider experience when reimbursement incentives change?

• What does a health plan do when regulations, subsidies, and market incentives interact?

• What happens when a policy that looks clean on paper collides with administrative reality?

Pegasus exists to connect those two views.

The top-down view helps explain federal programs and market-wide trends.

The bottom-up view helps explain how those policies actually work for households, employers, health plans, providers, advisors, brokers, and other stakeholders navigating the system every day.

Both views are necessary.

A policy can be well-intended and still create distorted incentives.

A subsidy can improve premium affordability and still leave families exposed to high out-of-pocket costs.

A regulation can protect consumers in one area while creating unintended consequences somewhere else.

A coverage model can appear efficient in a spreadsheet but fail if it cannot be explained, administered, or implemented clearly.

That is the gap Pegasus was created to study.

What we will focus on

Pegasus will examine the full healthcare financial ecosystem, including:

• Health insurance market dynamics.

• Care delivery and provider operations.

• Provider reimbursement models.

• Revenue cycle management.

• Claims, eligibility, billing, and payment workflows.

• Patient cost exposure.

• Employer-sponsored insurance.

• ACA individual markets.

• Medicare.

• Medicaid.

• Federal employee health programs.

• Veterans health systems.

• Medical Loss Ratio incentive design.

• Vertical integration.

• ACA subsidy mechanics.

• Cash-pay versus negotiated pricing.

• Regulatory incentive structures.

• Interoperability, EHR/EMR systems, and data exchange.

• Administrative complexity, fraud, waste, abuse, and structural arbitrage.

The goal is not to study these issues in isolation.

The goal is to understand how they interact.

Healthcare is not one market. It is a series of connected markets, public programs, private contracts, care delivery systems, billing infrastructure, regulatory systems, administrative workflows, and household decisions.

When incentives are misaligned, the result is often higher costs, opaque pricing, fragmented care, administrative waste, billing friction, delayed payments, confusing patient responsibility, and frustration for almost everyone involved.

No single stakeholder may intend those outcomes.

But all of us are forced to navigate them.

What you can expect here

This Substack will be a home for Pegasus Health Institute’s public writing, policy analysis, market commentary, and research.

You can expect posts on:

• Federal healthcare finance and budget outlooks.

• Medicare, Medicaid, ACA, and employer market trends.

• Employer coverage and reimbursement-based models like ICHRA.

• Provider reimbursement, care delivery, and operational incentives.

• Revenue cycle management, claims, eligibility, billing, and payment workflows.

• Healthcare affordability, patient cost exposure, and price transparency.

• Medical Loss Ratio, vertical integration, and market consolidation.

• Subsidy structures, regulatory incentives, and market behavior.

• Interoperability, EHR/EMR systems, and healthcare data exchange.

• Fraud, waste, abuse, and structural arbitrage.

• Practical policy ideas that connect access, affordability, quality, accountability, and sustainability.

Some posts will be short explainers.

Some will be deeper policy essays.

Some will respond to federal reports, proposed regulations, or emerging market developments.

Some will explore new models for improving the design and function of healthcare markets.

The goal is to make complex healthcare finance issues clearer, more practical, and more connected to real-world experience.

Our starting point

Pegasus begins with a simple belief:

Healthcare reform cannot succeed if it ignores the incentives that drive behavior inside the system.

Coverage matters.

Access matters.

Affordability matters.

Program integrity matters.

Competition matters.

Consumer experience matters.

But none of those goals can be achieved sustainably if the underlying mechanics of the market push stakeholders in the wrong direction.

That is why Pegasus will focus on the structure beneath the surface.

Not just what programs cost, but why they cost what they do.

Not just whether people have coverage, but whether that coverage works.

Not just whether a policy sounds good, but how it changes behavior.

Not just whether a market exists, but whether that market is designed to produce better outcomes.

Who is behind Pegasus

Pegasus Health Institute is headed by Joshua Brooker, founder of Helping Health and a healthcare market strategist working at the intersection of healthcare finance, insurance markets, care delivery, billing infrastructure, consumer affordability, technology, and regulatory policy.

Joshua brings a practical, multidisciplinary perspective to this work. His background combines formal training in finance, direct experience inside the individual health insurance market, technology development, consumer advocacy, and years of engagement with federal regulators, congressional staff, industry stakeholders, and media outlets on healthcare policy and market dynamics.

That combination shapes the Pegasus lens.

Pegasus is not designed to study healthcare policy only from a distance. It is designed to connect federal policy, market incentives, operational workflows, and the real-world decisions facing households, employers, advisors, health plans, providers, healthcare-focused vendors, and policymakers.

A note on tone

Pegasus is nonpartisan, but not passive.

We will ask hard questions.

We will look for misaligned incentives.

We will challenge assumptions.

We will try to identify where policy design and practical execution are disconnected.

But we will do that with a focus on constructive solutions.

Healthcare finance is too important to be reduced to slogans. The system is too complex for simple answers. Families, employers, taxpayers, providers, and policymakers deserve better than surface-level debate.

The work ahead requires clearer analysis, better models, and a deeper understanding of how healthcare markets actually function.

That is the work Pegasus is here to do.

Welcome

Thank you for being here at the beginning.

Pegasus Health Institute was created to help policymakers, industry leaders, employers, advisors, innovators, and the public better understand where healthcare markets are headed and how they can be improved.

We will study healthcare finance from the top down and the bottom up.

We will focus on incentives, market mechanics, and practical solutions.

And we will work to help define better models for access, affordability, and sustainability in American healthcare.

Healthcare finance is complicated. But the path forward begins with understanding how the system actually works.

Welcome to Pegasus.

The federal government does not have one health insurance program.

It has several large financing systems sitting beside each other: Medicare, Medicaid, employer-based coverage, the ACA marketplaces, the Basic Health Program, and other smaller subsidy structures.

Each one has its own rules. Each one has its own politics. Each one has its own budget story.

But households do not experience them as separate policy silos.

A person can move from Medicaid to the ACA marketplace. From employer coverage to self-employment. From the individual market to Medicare. From a traditional group plan into an ICHRA. From subsidized coverage to uninsured status because of a missed notice, a documentation issue, or a change in income.

That is why CBO’s February 2026 baseline projections matter.

They do not simply tell us which federal programs cost the most. They reveal something larger about where the American health financing system is headed.

The next decade will be defined by two forces:

Fiscal pressure and coverage transition.

Medicare will remain the dominant long-term federal cost pressure. Medicaid is projected to cover fewer people while spending continues to grow. Employer coverage remains the largest source of insurance. And the ACA individual market, while small in federal budget terms, is becoming increasingly important as the bridge between coverage systems.

That bridge may become one of the most important pieces of health policy infrastructure in the country.

The big picture: Medicare dominates federal health subsidy spending

CBO projects that federal subsidies for health insurance will total $33.5 trillion from 2026 through 2036.

The breakdown is striking:

Medicare accounts for nearly half of projected federal health insurance subsidies, while covering roughly one-fifth of the population. ACA premium tax credits and related spending account for less than 4 percent of total federal health insurance subsidies.

That matters because public debate often focuses heavily on the ACA marketplaces. That debate is important, but it is not where the largest federal health financing pressure sits.

The largest pressure is Medicare.

CBO projects Medicare spending to increase by 88 percent from 2026 to 2036, making it the fastest-growing major component of mandatory outlays in the projection window.

This does not mean the ACA marketplaces are unimportant. It means they are important for a different reason.

Medicare is the largest fiscal pressure.

The individual market is the transition point.

Medicare’s future is increasingly tied to prescription drug spending

One of the most important details in the CBO presentation is the shift in projected Medicare Part D spending.

CBO notes that private plan bids for the Part D benefit anticipated a 35 percent increase in annual per-enrollee costs in 2026, higher than CBO expected. As a result, CBO increased its projection of Medicare prescription drug spending by $0.6 trillion over the 2026 to 2035 period.

By 2035, CBO now projects Part D spending per beneficiary to exceed $4,000, compared with less than $3,000 in the January 2025 baseline projection.

That is not a small adjustment. It is a reminder that drug spending remains one of the most powerful cost drivers across the health financing system.

For consumers, this also reinforces an important point: affordability is not just premium affordability.

A low-premium plan can still fail a household if the drug formulary, pharmacy network, deductible, coinsurance structure, or out-of-pocket exposure does not match the person’s real healthcare needs.

That lesson applies far beyond Medicare.

It applies in employer coverage. It applies in Medicaid managed care. It applies in ACA marketplace coverage. And it will become increasingly important as employers and workers evaluate new financing models like ICHRA.

Medicaid is projected to shrink in enrollment, but not in financial pressure

CBO projects Medicaid and CHIP average monthly enrollment to decline from 82 million in 2026 to 73 million in 2036.

The largest projected decline is among adults made eligible by the Affordable Care Act. That population is projected to fall from 17 million in 2026 to 10 million in 2036, a decline of roughly 40 percent.

At first glance, that may look like a straightforward spending reduction story.

It is not.

CBO also shows Medicaid spending continuing to grow even as enrollment declines. In fact, the presentation notes that fiscal year 2026 had already seen two of the highest monthly Medicaid spending totals on record. CBO points to prescription drugs, home- and community-based services, and behavioral health services, including Applied Behavioral Analysis services, as key spending drivers.

That creates a difficult policy reality.

Medicaid can cover fewer people and still become more expensive.

This is one of the central challenges in healthcare finance: enrollment counts do not tell the whole story. The acuity, service mix, unit cost, and needs of the covered population matter.

If lower-cost enrollees leave the program while higher-need populations remain, total spending pressure can continue even as enrollment falls.

The Medicaid-to-marketplace transition will become more important

If Medicaid enrollment declines, people do not simply disappear from the healthcare system.

Some will become uninsured. Some will move to employer coverage. Some will become eligible for ACA marketplace subsidies. Some will experience gaps because they miss a notice, fail a verification step, misunderstand their eligibility, or do not know where to go next.

This is where the individual market becomes more important than its budget line suggests.

CBO projects ACA premium tax credits and related spending to total about $1.227 trillion from 2026 to 2036. That is small compared with Medicare and Medicaid, but the individual market plays a unique role.

It serves people in transition.

That includes:

People leaving Medicaid.
Self-employed workers.
Early retirees.
People between jobs.
Workers without affordable employer coverage.
Families with fluctuating income.
Employees offered an ICHRA.
Households that do not fit neatly into the traditional employer coverage model.

This is the part of the system policymakers often underestimate.

The ACA marketplace is not just an insurance shopping website. It is a transition layer between public coverage, employer coverage, and the uninsured.

If that transition layer is difficult to navigate, people lose coverage.

Marketplace enrollment is projected to decline under current law

CBO projects average enrollment in the ACA marketplaces and Basic Health Program to decline compared with its January 2025 baseline.

The January 2025 projection was 17.5 million.

The February 2026 projection is 15.1 million.

That is a projected reduction of 2.4 million people over the 2026 to 2035 period. CBO attributes the reduction to legislative changes, the marketplace rule, and other technical changes.

The marketplace rule is especially important because CBO describes it as changing premium contributions, enrollment periods, verification procedures, and payment requirements for marketplace coverage.

That should not be overlooked.

Administrative rules are not just paperwork. They are coverage policy.

When enrollment periods change, coverage changes.

When verification rules change, coverage changes.

When payment requirements change, coverage changes.

When consumers face more friction, some legitimate enrollments will not happen.

That does not mean program integrity is unimportant. It is very important. Improper enrollment undermines trust, increases costs, and creates instability.

But the operational challenge is to improve integrity without creating unnecessary barriers for eligible households.

That is much harder than it sounds.

Employer coverage remains the backbone of the system

CBO projects employment-based coverage to remain the largest source of health insurance, covering an average of 169 million people, or 47.7 percent of the population, from 2026 to 2036.

That is why employer coverage cannot be treated as separate from federal health finance.

The federal government subsidizes employer coverage through the tax exclusion. Employers make plan design decisions. Workers experience those decisions through premiums, deductibles, networks, payroll contributions, and family affordability.

As employer costs rise, employers will continue looking for alternatives.

Some will stay with traditional fully insured group plans. Some will self-fund. Some will use level-funded arrangements. Some will explore QSEHRA or ICHRA. Some will use hybrid models.

The next decade is unlikely to produce one dominant employer coverage model.

It is more likely to produce a more segmented employer market.

That creates opportunity, but also risk.

For ICHRA and other reimbursement-based models to work well, the individual market must be stable, understandable, and operationally strong. Employers need clear guidance. Employees need real support. Brokers, TPAs, platforms, issuers, and exchanges need better coordination.

A reimbursement model is not just a funding mechanism.

It is an ecosystem.

The uninsured projection should keep us honest

CBO projects an average of 36.1 million uninsured people, or 10.2 percent of the population, from 2026 to 2036.

That number should sit at the center of any serious conversation about healthcare finance.

The federal government is projected to spend tens of trillions of dollars subsidizing health insurance, yet more than one in ten people are still projected to be uninsured.

That tells us something important.

The coverage problem is not only a funding problem.

It is also a coordination problem.

People become uninsured when they fall between systems. They lose Medicaid and do not transition to the marketplace. They lose employer coverage and miss a special enrollment period. Their income changes and they do not understand how subsidies work. Their paperwork does not match the system’s expectations. Their employer offers coverage they cannot afford. Their plan technically exists, but the network or cost-sharing does not meet their needs.

A better health financing system has to care about the spaces between programs.

That is where many people fall through.

What this means for the next decade

CBO’s baseline points toward five major conclusions.

1. Medicare will dominate the long-term federal cost conversation

Medicare is the largest projected federal health subsidy category and the fastest-growing major mandatory health outlay. Any serious conversation about federal health finance has to deal with Medicare, demographics, drug costs, and program design.

2. Medicaid policy will be defined by enrollment contraction and cost intensity

Medicaid is projected to cover fewer people, especially among ACA expansion adults. But spending pressure remains, driven by the needs and costs of the remaining population.

3. The individual market is small, but strategically critical

ACA subsidies represent a small share of total federal health insurance subsidies, but the individual market is becoming more important as a transition pathway for people moving between coverage sources.

4. Employer coverage will remain dominant, but more varied

Employer coverage is still the largest source of insurance in the United States. But the employer market is changing, and financing models like ICHRA will test whether the individual market can support more employer-linked enrollment.

5. Administrative design will increasingly determine coverage outcomes

Enrollment rules, verification requirements, payment policies, and renewal processes directly affect who gets covered. Program integrity and access must be designed together, not treated as opposing goals.

The Pegasus view

At Pegasus Health Institute, we believe healthcare finance should be studied from both the top down and the bottom up.

The top-down view shows federal spending, program baselines, budget pressure, and subsidy categories.

The bottom-up view shows how households, employers, brokers, advisors, plans, providers, and state systems experience those policies in real life.

CBO’s baseline is a top-down document.

But its implications are deeply bottom-up.

A Medicaid enrollment decline is not just a budgetary event. It is a household transition.

A marketplace rule is not just a regulatory adjustment. It is a consumer experience change.

A Part D projection is not just a Medicare spending issue. It is a warning about drug cost pressure across the system.

An employer coverage statistic is not just an enrollment category. It is the foundation of how nearly half the country accesses healthcare.

And an uninsured projection is not just a number. It is a reminder that the system’s seams still matter.

The next decade of healthcare finance will not be defined only by how much the federal government spends.

It will be defined by whether the system can manage transition.

Medicare will grow. Medicaid will change. Employer coverage will evolve. The individual market will become more important. And millions of people will continue moving between programs that were not always designed to work together.

That is the crossroads.

The future of federal health finance is not just about the size of subsidies.

It is about whether America can build a more coherent coverage architecture, one that protects affordability, improves accountability, and helps people move between coverage systems without falling through the cracks.