EVV in 2026: the FMAP penalty is now 1%, and states are passing the cost down

The Electronic Visit Verification mandate from Section 12006 of the 21st Century Cures Act is no longer a new rule, a transition, or a "ramp-up." For personal care services, the federal Medicaid match (FMAP) reduction for non-compliance hit its statutory ceiling of 1 percentage point starting in 2023. For home health care services, the reduction reaches 0.75 points in 2026 and the full 1.0 point in 2027. States are not absorbing those reductions — they're passing them down to non-compliant providers through claim denials and recoupments.

If your agency is still treating EVV as a checkbox, the math has changed.

What Section 12006 actually requires

The statute mandates that every Medicaid-funded personal care visit and home health visit electronically capture six data elements:

1. The type of service performed
2. The individual receiving the service
3. The date of service
4. The location of service delivery
5. The individual providing the service
6. The time the service begins and ends

Source: CMS Medicaid.gov EVV guidance (per Section 12006 of Pub. L. No. 114-255).

The data must be captured at the visit, not reconstructed afterward, and must be transmitted to a state-designated aggregator. Paper timesheets backed into a system at the end of the week do not satisfy the statute regardless of how diligently they're filed.

The FMAP reduction schedule, finally fully phased in

The penalty is structured as a permanent annual reduction in the federal match a state receives for the affected service category. The schedule is set in statute and steps up each year until it hits the 1.0% ceiling:

Source: CMS Medicaid policy guidance, FAQ 051618, confirmed in state EVV FAQs including Rhode Island EOHHS.

A 1 percentage point FMAP reduction sounds modest. For a state whose Medicaid HCBS spend on PCS runs in the hundreds of millions, it's tens of millions of dollars per year. No state Medicaid director absorbs that — the cost is recovered from non-compliant providers through claim edits.

"Soft edits" are gone

The original CMS framework let states accept claims with EVV data quality issues and flag them for follow-up. That phase is over. State aggregators (most commonly Sandata or HHAeXchange, depending on the state's procurement) have moved to "hard edits" — claims with a missing required element or a mismatch between the EVV record and the billing claim are rejected at submission.

The most common rejection reason in 2026 is the same one it has been since the aggregator model matured: "Record Not Found" — the billing claim doesn't perfectly match a corresponding EVV record. Mismatches are usually one of:

• Caregiver clock-in time more than ~7 minutes off the authorized service window
• Service code on the bill doesn't map to the service type recorded at clock-in
• Member ID variant (Medicaid ID vs. waiver ID vs. MCO ID) used on the claim differs from the EVV record
• GPS coordinates outside the recipient's authorized service location with no override reason recorded

Each of these has the same operational fix: the data discipline has to live at the point of capture, not in the back-office reconciliation. Once a claim is denied, you have ~30 days under most state cycles to identify, correct, resubmit, and re-adjudicate. Agencies that batch their corrections weekly are losing 30%+ of their corrections to timely-filing limits.

The "Good Faith Effort" exemption is closed for ongoing compliance

The Good Faith Effort exemption available under Section 12006(b)(3) was a one-time mechanism states could invoke during the original compliance ramp. CMS has approved or denied state-level GFE requests on the public record (e.g., Arkansas, South Carolina, Massachusetts) but the exemption does not extend forward as a recurring backstop. A state in compliance today that lets compliance slip in 2026 is back on the FMAP penalty schedule the next quarter.

What we'd be auditing in 2026

If you bill any volume of Medicaid PCS or HHCS, four checks are worth doing this quarter:

Pull your last 90 days of EVV-related claim denials and rank them by reason code. If "Record Not Found" or any aggregator-side data-mismatch code is in your top three, the leak is at the visit, not in billing. Field-side fixes pay better than billing-side fixes.

Check your aggregator's reconciliation lag. Some states' aggregators surface EVV-billing mismatches at submission. Others surface them only on a delayed reconciliation report — sometimes two weeks after the visit. If your state is in the second category, the agency that's processing those reports daily catches errors inside the 30-day correction window. The one that processes them monthly does not.

Confirm your GPS proximity tolerance and your override workflow. A non-trivial share of valid visits happen outside the authorized address — the recipient is at a hospital outpatient appointment, a senior center, a doctor's visit, a family member's home for the weekend. Those need a documented override at the time of clock-in. If your override rate looks higher than 5–10%, you're using overrides as a workaround for stale member-address data instead of a real exception process — and that's a flag in any state audit.

Confirm telephonic backup actually works. GPS-only EVV fails when the caregiver's phone has no signal. Federal guidance allows telephonic verification as a backup. If your system requires the caregiver to retroactively enter visit times after returning to signal, you're capturing reconstructed data, not contemporaneous data, and a state audit will treat those visits the same as paper timesheets.

The Cures Act EVV regime is no longer about compliance posture — it's about whether your data architecture survives the day a state moves your aggregator to hard-edit mode. Several states already did. The rest will.