A single flag in Deloitte-built Medicaid eligibility software — whether the system recognizes an applicant as disabled — decides whether the applicant receives comprehensive care or is routed into a narrow plan covering family planning services. Three documented failures across Michigan, Texas, and Tennessee show the same design flaw producing the same structural outcome state by state: outright denial in Michigan, misdirection into a limited program in Texas, and a constitutional violation finding in Tennessee. A 2010 Michigan audit found the state cannot independently maintain the software, creating a dependency cycle in which the vendor assesses its own accuracy and the state lacks the capacity to challenge that assessment. With Deloitte operating similar systems in at least 25 states, the structural exposure documented in three likely extends further.

Marie Noon, a 48-year-old Michigan woman with adult-onset Still’s disease, applied for Medicaid in 2025 after losing private insurance. The state denied her coverage. The denial notice cited incorrect income information and stated she was not disabled, according to documents reviewed by KFF Health News and interviews with Noon and her attorney. Anastassia Kolosova, a supervising attorney with Disability Rights Michigan who represented Noon, said the state’s computer system had all the information needed to recognize Noon’s disability but did not use it. By failing to register her as disabled, the system applied the wrong income formula — the standard formula instead of the disability-adjusted one — and concluded she earned too much to qualify. Noon paid hundreds of dollars out-of-pocket for prescriptions she cannot function without. “I’m toast,” she said of going without them. Her doctor agreed to fewer visits to avoid bills. “It was kind of a nightmare,” Noon said.

In Texas, Lilly Livingston, a 22-year-old woman with Down syndrome who had undergone jaw reconstruction surgery and relied on speech and occupational therapy, was cut off from comprehensive Medicaid benefits in 2023. Terry Anstee, an attorney with Disability Rights Texas, sent a September 2023 email with the subject line “URGENT” to a state Medicaid staffer, saying an unknown “error” had stripped Livingston of her benefits and that “her recovery is contingent on Medicaid.” The state enrolled her instead in Healthy Texas Women, a limited program covering breast and cervical cancer screenings and family planning services. Texas Health and Human Services spokesperson Jennifer Ruffcorn confirmed the erroneous enrollment but disputed that Livingston experienced a coverage lapse; Anstee said she did. Livingston’s mother, Marie, called the loss of coverage “a nightmare.”

In Tennessee, a class-action lawsuit brought by Medicaid beneficiaries in 2020 alleged that the state’s Deloitte-built system “does not reliably test for eligibility” for several categories of people with disabilities. A federal judge sided with the beneficiaries in 2024, ruling that Tennessee violated federal law and the U.S. Constitution. The lawsuit did not name Deloitte as a defendant.

How the failure was built into the system

Three interacting chains explain the failure — how it occurs, why it was never corrected, and why it persists undetected.

The Machine chain is the proximate cause. The Bridges system checks a single disability-status input field at intake rather than cross-referencing existing state disability records. When the flag is missing — even when the state already holds the documentation establishing the applicant’s disability — the system applies the wrong income formula. In Noon’s case, the state had the necessary information but the system did not retrieve it. The same architecture appears in Texas and Tennessee, suggesting a design-family vulnerability rather than a series of independent configuration errors.

The Method chain explains why the failure has persisted uncorrected for at least a decade. A 2010 report from Michigan’s Office of the Auditor General found that Deloitte “did not provide effective project administration” and “did not transfer knowledge and skills” to state officials, leaving the state unable to “independently maintain and operate Bridges.” The original contract, valued at roughly $70 million, ballooned by $50 million — a 71% increase — according to the audit, without producing independent state capability. The contracting structure of the era specified deliverables (a functioning system) rather than capability-transfer milestones, creating vendor lock-in. The state must rely on Deloitte’s own assessment of system anomalies. Michigan DHHS spokesperson Lynn Sutfin said the state is now fully capable of operating and maintaining Bridges independently, but the 2010 audit finding established a structural dependency that governed the system’s operation for roughly 15 years.

The Measurement chain explains why the gap goes undetected. Sutfin said the state “is not aware of any widespread or systemic issues” within Bridges related to disability eligibility. Deloitte spokesperson Karen Walsh said it found “no system anomalies causing routine denials of Medicaid for people with disabilities” and that eligibility systems are “owned by the states and built to their unique specifications.” No accuracy-rate monitoring on disability eligibility pathways exists in the contract. The historical detection mechanism has defaulted to external legal challenge rather than embedded audit: Disability Rights Michigan reported a growing number of denial calls, and the Tennessee federal ruling independently validated the pattern.

These three chains form a closed dependency cycle. The state depends on a system it cannot independently audit. The system produces errors. The vendor denies anomalies. The state continues the contract. The 2010 audit finding that the state could not independently maintain Bridges now serves as a predictor of the current insulation dynamic — the same structural vulnerability that produced cost overruns in 2010 now shields the system from independent error detection. The cycle is not silently closed; it is a structural self-perpetuating loop: the state’s dependency on the vendor, the system’s failure, the state’s inability to audit independently, the reliance on vendor self-assessment, the vendor’s denial of anomalies, the state’s contract continuation — each step reinforces the next.

Who has power, who has the cost

The dependency cycle produces a sharp asymmetry in who bears the consequences. By power, legitimacy, and urgency:

Disabled beneficiaries are dependent stakeholders. They hold a federal entitlement to coverage and face time-critical health consequences from coverage lapses — Noon’s medications, Livingston’s post-surgical therapy — but they lack the power to compel system changes. Their cases are corrected only when an advocacy organization intervenes. The silent population — disabled applicants without legal representation — never sees its errors fixed. Their absence from the record is itself a finding: the map underestimates the true scale of harm.

Deloitte is a dominant stakeholder. It holds structural power as the entrenched vendor, with contract revenue of roughly $768 million in Michigan alone since 2006 across at least 25 states nationally. Its legitimacy as a contracted party is uncontested, but its urgency to seek systemic reform is structurally low: individual case remediation costs less than system redesign, and contract revenue does not depend on accuracy outcomes. Spokesperson Walsh’s framing — systems are “owned by the states and built to their unique specifications” — is the vendor’s BATNA: it deflects responsibility to the state while the state lacks the independent capacity to audit the system.

State Medicaid agencies sit in a contested position — definitive in jurisdictions with active legal exposure after the Tennessee ruling, dominant elsewhere. Michigan DHHS, Texas HHSC, and Tennessee each have different levels of exposure. They hold formal authority over eligibility determinations but are constrained by the dependency the audit identified. Their BATNA — seeking federal enforcement or contracting with a different vendor — takes years and carries transition risk, as the 2010 audit’s 71% cost overrun on the original contract demonstrates.

Advocacy organizations are rising-urgency stakeholders. Disability Rights Michigan and Disability Rights Texas surface individual cases and apply media pressure. KFF Health News’s investigation, for instance, prompted Michigan to acknowledge changes to its Plan First enrollment logic. But structural dependency on state cooperation limits what advocacy can achieve. The Tennessee federal court ruling provides a new legal lever — a federal judge’s finding that a Deloitte-built system “does not reliably test for eligibility” gives Disability Rights Michigan and counterparts a precedent-based argument — but effects remain state-specific until tested in other jurisdictions.

KFF Health News is a discretionary stakeholder. High agenda-setting power but no ongoing stake in Medicaid operations. Its role as a transparency pressure point is episodic, dependent on publication cycles.

CMS is a definitive stakeholder if it acts. The federal Centers for Medicare and Medicaid Services holds enforcement authority, statutory oversight legitimacy, and rising urgency after the Tennessee ruling. All three dimensions of the Mitchell-Agle-Wood salience classification — power, legitimacy, urgency — are present. Its absence from the public narrative leaves the enforcement loop incomplete. The question is not whether CMS has the authority to impose corrective action plans or withhold federal matching funds; it is whether the political pressure to keep enrollment numbers high will override the enforcement mandate.

What the precedent and the legislation mean together

Two developments raise the stakes. The first is the Tennessee precedent. A federal judge’s finding that a Deloitte-built system violated federal law and the Constitution provides, for the first time, judicial validation that the disability-recognition failure is a systemic design problem rather than a collection of isolated errors. The ruling did not name Deloitte as a defendant — the state was the party held liable — but it establishes a legal framework that advocacy organizations in other states can invoke. Disability Rights Michigan’s Kolosova said she has been unable to get a meeting with Michigan officials to understand the underlying problem that deprived Noon of health coverage. The Tennessee precedent gives that effort a new dimension: the question is no longer whether the system has a flaw, but whether the state’s failure to correct it — enabled by its dependency on the vendor — creates its own legal exposure.

The second is federal legislation. The One Big Beautiful Bill Act requires states to update their Medicaid computer systems to verify details such as employment, with companies including Deloitte, Accenture, and Optum being paid millions in taxpayer funds to make the changes. The changes are projected to strip Medicaid from roughly 7.5 million people and SNAP from 2.4 million people by 2034. Pamela Herd, a University of Michigan professor who researches bureaucratic obstacles to accessing government benefits, said, “When these administrative systems get overloaded, everyone gets impacted.” She added, “The systems are going to be really, really strained.” The structural problem identified in the 2010 audit — states that cannot independently verify their vendor’s work — will now be applied at a larger scale, with more eligibility rules to process, more verification requirements to implement, and the same dependency structure governing whether errors are detected and corrected.

Additional considerations

The structural exposure is this: a design flaw in Medicaid eligibility software denies or misroutes disabled applicants; the contracting structure prevents states from independently identifying and fixing that flaw; the federal oversight body with enforcement authority has not yet acted; and the system is about to become more complex. For the roughly 15.5 million disabled Medicaid beneficiaries nationwide, the unresolved exposures — failure patterns across the other ~22 Deloitte states, the silent unrepresented population, CMS’s enforcement posture, and the One Big Beautiful Bill Act rollout — are not speculative; each is structurally entailed by the failure mechanism documented above.

Three correctives would address the root cause at each level of the three-factor interaction. A validation layer within Bridges that cross-references disability determination records from other state databases before applying income formulas — the Noon case provides the specific failure signature for testing. Contractual accuracy-rate monitoring on disability eligibility pathways as a service-level metric, with independent state audit rather than vendor self-reporting. And structured knowledge transfer as a contractual deliverable with specific milestones and independent testing of state personnel’s ability to validate eligibility rules — the 2010 Auditor General finding provides the contractual language to avoid, and the Tennessee 2024 federal ruling provides precedent that failure to ensure accurate disability eligibility testing can expose a state to constitutional liability.

The state’s claim of independent capability today introduces an ambiguity. If evidence shows that Deloitte contracts post-2010 include robust knowledge-transfer requirements and the state’s independent-capability claim is fully substantiated, the Method root cause would downgrade from root cause to contributing factor, narrowing the dominant causal chain to Machine alone. But the 2010 audit finding that the state could not independently maintain Bridges, combined with the multi-state pattern of identical failures, the Tennessee court’s design-level finding, and the absence of documented independent state audits of the disability-recognition logic, makes the structural dependency explanation more parsimonious than the configuration-error alternative. The insulation cycle — state dependency, system failure, vendor self-assessment, contract continuation — remains the binding constraint on any corrective action the system does not generate from within.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Relationship Mapping
Extracts the network of ties among people, institutions, and entities.
Root-Cause Analysis
Traces a symptom back along its causal chain to the conditions that actually generated it.
Stakeholder Mapping
Charts the parties to a situation — their interests, power, and alignments.