PAN Lab example
Tennessee TennCare TEDS
The notice that never came: an automated Medicaid eligibility system
An automated system decides Medicaid eligibility and runs renewals on its own, then generates the termination notices that are supposed to let people appeal. Modeled on Tennessee's TEDS. When the notice is misleading, deficient, or sent to the wrong household, the right to a hearing exists on paper and never reaches the person; correction flows only to those with the luck and lawyering to force it.
Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.
What this models
This example runs on the TEDS-class automated eligibility-and-notice system network: 6 components and 10 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.
Evidence base: 4 assumed · 2 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.
- assumed
This models the automated-eligibility-and-notice pattern documented in the Tennessee TEDS (A.M.C. v. Smith) case file — not a reconstruction of the actual system.
- baseline
The correction loop that mattered here is the Medicaid fair hearing: a statutory right that existed in law and was severed in practice by misleading, deficient, and misrouted notices and a withdrawn good-cause override — so the notice-to-hearing trigger runs weak at baseline.
- baseline
The store-to-model re-feed encodes single-error propagation: converted legacy records, including a documented keying error, re-enter every automated ex parte renewal, so one bad record compounds rather than averaging out.
- assumed
The record-side reconciliation check is drawn on the map but runs dry at baseline: terminations were actioned and notices dispatched with nothing verifying that a valid, understandable notice reached the enrollee before coverage ended — the due-process check the court found missing, and the gap the replication-reconciliation lever closes.
- assumed
The court's ADA finding that people with disabilities faced additional, unequal burdens, and the outcomes of real terminated enrollees, are documented in the case file and measured outside any diagram like this one. This Lab models institutional propagation, not demographics or client outcomes, and estimates no benefit change for any served person.
- assumed
The vendor-side defect-remediation loop is externalized from this map: fixes to the engine itself run through vendor change orders documented as taking months to years and hundreds of thousands of dollars per defect, so the only correction pathways drawn here are the case-level ones (slow caseworker fixes and the thin hearing loop). The vendor-gate lever is where that external fix loop is governed.
What this example does not show
- The documented harm is loss of Medicaid coverage for real enrollees, with people with disabilities found to face additional, unequal burdens. The Lab models institutional propagation, not client outcomes or demographics, and estimates no benefit change for any served person; that harm is documented in the case file and measured outside any diagram like this one.
Sources and evidence
What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.
In A.M.C. v. Smith (No. 3:20-cv-00240, M.D. Tenn.), a federal court held after a five-day bench trial that Tennessee's Deloitte-built TEDS automated Medicaid eligibility system, operational statewide since March 19, 2019 for a program covering roughly 1.7 million residents, produced wrongful terminations, wrong-household assignments, and misleading or missing notices that violated the Medicaid Act, the Fourteenth Amendment's Due Process Clause, and the Americans with Disabilities Act; the 116-page opinion, issued August 26, 2024 by Judge Waverly D. Crenshaw Jr., ordered mediation before considering an injunction.
empirical- Trade press StateScoop (Keely Quinlan), Automated Medicaid system contributed to thousands losing health care coverage (2024) https://statescoop.com/tenncare-automated-medicaid-healthcare-coverage-2024/
- Trade press Stotler Hayes Group LLC (Erin Sailor), Holding State Medicaid Agencies Accountable: A Federal Court Issues Ruling on Deficiencies and Discrimination in TennCare (2024) https://stotlerhayes.com/holding-state-medicaid-agencies-accountable-a-federal-court-issues-ruling-on-deficiencies-and-discrimination-in-tenncare/
- Academic Georgetown University Center for Children and Families (Leonardo Cuello), Federal Judge in Tennessee Sides with Individuals Terminated from Medicaid (2024) https://ccf.georgetown.edu/2024/09/06/federal-judge-in-tennessee-sides-with-individuals-terminated-from-medicaid-finds-numerous-violations-in-tennessee-medicaid-eligibility-process/
- Advocacy National Health Law Program, Major Litigation Win: Court Rules Tennessee's Medicaid Program Wrongfully Denied Health Care for Thousands (2024) https://healthlaw.org/news/major-litigation-win-court-rules-tennessees-medicaid-program-wrongfully-denied-health-care-for-thousands/
Where this connects
Institutional pressures in this domain
- Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
- Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
- Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
- Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.
All of them in context on the Public benefits & eligibility domain page.
Levers available here and the patterns behind them
- Understand the system — Understand the system
- Check copied records — Reconcile copied records
- Assign a challenger — Structured dissent
- Review on schedule — Oversight cadence & retrospectives
- Require sign-off — Conformity assessment gate
- Gate vendor updates — Vendor quality gate
- Pause AI on alarms — Deployment circuit-breaker
- Mark AI-written records — Provenance labeling
- Upgrade model — Improve the model
- Gate record entries — Human-in-the-loop write gating
- Vet connections — Connection authorization
- Escalate checks — State-feedback vigilance
Documented case histories
- Tennessee TennCare TEDS
- Michigan MiDAS
- Robodebt (Australia)
- Indiana / IBM eligibility modernization
- Rotterdam welfare-fraud risk model
- Arkansas ARChoices / ARIA
- Netherlands childcare-benefits scandal (Toeslagenaffaire)
- SyRI (Netherlands)
- CNAF benefit-fraud risk score (France)
- Forsakringskassan VAB fraud-selection profile (Sweden)
- Udbetaling Danmark data-driven control (Denmark)
- BOSCO (Spain)
- Serbia Social Card (Socijalna karta)
- UK DWP Universal Credit Advances fraud model
- ID.me identity verification as an unemployment eligibility gate
- Medicaid unwinding: automated ex parte renewal at population scale
- INSS auto-analysis: when the productivity metric makes denial the fastest way out
- Samagra Vedika
- Workforce Australia Targeted Compliance Framework: automated payment sanctioning after Robodebt
- NYC MyCity business chatbot
- Nevada DETR generative-AI unemployment appeals