PAN Lab example
Tennessee TennCare TEDS
The notice that never came: an automated Medicaid eligibility system
TEDS decides Tennessee Medicaid eligibility and generates the notices people need to appeal. A federal court held its wrong terminations and misleading notices unlawful.
See more
TEDS, Tennessee's Eligibility Determination System, is rules-based software that decides who qualifies for Medicaid in Tennessee. The Division of TennCare, the state agency that runs Tennessee's Medicaid program, operates it, and Deloitte built it. It applies eligibility rules, renews coverage automatically, and generates the notices enrollees receive.
What the system is
The sources describe TEDS as a rules-based automated, or “algorithmic”, system, not an AI or machine-learning model. Its public portal is TennCare Connect. It has run statewide since March 19, 2019, for a program covering roughly 1.7 million residents.
This network models the pattern the case documents. It is not a reconstruction of the actual system.
Who built it
Deloitte built TEDS as the systems integrator of a three-contract program, the firm that builds the system and joins its parts. It took over after an earlier build under a different contractor failed. TEDS was built on components from Georgia's system.
Cost figures differ by source and scope. They range from a reported roughly $400 million system to an $823 million original contract with change-order amendments. Change orders are paid work added outside the contract's original scope.
Deloitte was not a named defendant. Reporting has tied Deloitte's Medicaid systems to recurrent errors across roughly two dozen states.
The lawsuit
A.M.C. v. Smith (No. 3:20-cv-00240, M.D. Tenn.) is a class action filed in March 2020 on behalf of 35 named child and adult plaintiffs. Secondary legal analysis describes the class as over 100,000 people terminated, plus over 100,000 qualified individuals with disabilities.
U.S. District Judge Waverly D. Crenshaw Jr. held a five-day bench trial, a trial before a judge without a jury, in November 2023.
What the court found
The court issued a 116-page opinion on August 26, 2024. It held that the system violated the Medicaid Act, the Fourteenth Amendment's Due Process Clause, and the Americans with Disabilities Act.
The court found that TEDS often failed to load data such as Social Security benefit receipt, disability status, and marital status. It assigned people to the wrong households and made incorrect eligibility determinations. It did not always check people terminated from one coverage category for others they might qualify for.
It issued “misleading and deficient” termination notices. A good-cause exception gives enrollees and applicants a right to a hearing about their eligibility if certain criteria are met. An unwritten policy refused the good-cause exception to people who never received written notice.
Judge Crenshaw wrote that “TEDS is flawed, and TennCare knows that it is flawed.” He also wrote that poor, disabled, and otherwise disadvantaged Tennesseans “should not require luck, perseverance, or zealous lawyering” to receive their benefits.
What happened next
Rather than stop the system at once, the court ordered mediation before considering an injunction, a court order to stop or require an action. Secondary coverage reports the mediation ran roughly six months.
As of late 2025 and into 2026, the case is in its remedies phase, the stage where the court decides what must be done about the harm. An appeal is pending at the U.S. Court of Appeals for the Sixth Circuit (No. 25-5660). TEDS remains in operation.
The central dilemma
Medicaid law entitles enrollees to a fair hearing, a formal appeal in which they can contest a decision about their coverage. Caseworkers could in principle override TEDS. The case file locates the failure in the notice, which connects a wrong determination to a person's ability to contest it.
When notices are misleading, deficient, or sent to the wrong household, the right to appeal becomes unreachable. A wrong automated termination then becomes final without anyone deciding that it should.
In the case file's reading, a fair process came to depend on having an advocate.
One data-entry mistake in the old system was copied into TEDS when records were converted. It merged people into the wrong households. The case file says it could repeat because a correction step was cut. The sources do not say which step.
What the available tools can and cannot address
A failure pathway is a link between two parts of the network where a mistake made by one part can be passed on to the other. A tool closes a pathway when mistakes stop passing along it.
This case has a budget of 12 units and offers twelve tools. Understand the system costs 3 units under Explore (No Targets) and Service Targets Only, and 4 under the two higher levels. Its stronger setting costs 6 at every level.
While Understand the system is on, four tools cost 1 unit less, or 2 less at its stronger setting, never below 1. They are Check copied records, Assign a challenger, Review on schedule, and Mark AI-written records.
Explore (No Targets) sets no targets. Under Service Targets Only, one tool is enough to meet them: Mark AI-written records, at 2 units, or Vet connections, at 3.
Under Service and Safety Targets, the targets can be met. That level asks you to close every failure pathway, among other targets. The cheapest way costs 10 units and uses four tools: Mark AI-written records, Gate record entries, Vet connections, and Escalate checks. Every combination that meets the targets includes the last three.
Here is what each does on this network. Mark AI-written records marks what TEDS wrote, so readers weigh it. Mistakes stop passing along the data read for each decision, the stored records read at renewal, and caseworkers reading the records.
Gate record entries requires sign-off before anything enters the case records. Mistakes stop passing along the pathway where TEDS writes determinations into them. Vet connections allows record copies and reads only where explicitly granted. Mistakes stop passing along the data read for each decision, the stored records read at renewal, and the terminations and notices sent.
Escalate checks raises caseworkers' checking when monitoring flags trouble. Mistakes stop passing along the pathway that sends determinations to caseworkers. Together the four close all six failure pathways.
Under All Governance Targets, this case is not fully addressable with the available tools. At that level, Vet connections and Check copied records work at reduced strength unless Understand the system is also on. Without it, the pathway that sends terminations and notices from the case records stays open.
With it, one combination within the budget closes every failure pathway. It is Understand the system, Gate record entries, Vet connections, and Escalate checks, for all 12 units. That level also asks for a larger, steadier gain in service, meaning the benefit the deployment delivers. This combination falls just short of it.
No tool offered here adds a way into a fair hearing. That is a finding about the deployment, not a gap in your approach.
Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.
What this models
This example runs on the TEDS-class automated eligibility-and-notice system network: 6 components and 10 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.
Evidence base: 4 assumed · 2 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.
Show all 6 assumptions
- assumed
This network models the pattern of automated eligibility decisions and notices documented in the Tennessee TEDS case, A.M.C. v. Smith. It is not a reconstruction of the actual system.
- baseline
The correction that mattered here is the Medicaid fair hearing. The right existed in law. Misleading, deficient, and misrouted notices, and refused good-cause exceptions, cut it off in practice. So the network draws the hearing as reachable through the notice.
- baseline
Records converted from the legacy system, including a documented keying error, a data-entry mistake, are read again at each automated renewal. So the network assumes one bad record can repeat its mistake at every renewal, instead of averaging out.
- assumed
The sources describe no step confirming that a valid, understandable notice reached the enrollee before coverage ended. The network draws that check so you can see where it would go. The tool Check copied records adds it.
- assumed
The court found, under the Americans with Disabilities Act, that people with disabilities faced additional, unequal burdens. That finding, and what happened to real enrollees, are in the case file, not this network. It estimates no change in benefits for anyone served.
- assumed
Fixes to TEDS itself run through Deloitte, outside this network. KFF Health News documents fixes to Deloitte-run benefits systems in other states taking months to years, and one fix costing $522,455. So the corrections drawn here are case by case: caseworkers' fixes and fair-hearing reversals. Gate vendor updates is the tool aimed at the vendor's side.
What this example does not show
Show all 1 limitation
- The documented harm is loss of Medicaid coverage for real enrollees. The court found that people with disabilities faced additional, unequal burdens. This example traces how mistakes pass inside the institution, not what happens to the people served or which groups they belong to. It estimates no change in benefits for anyone. The case file documents that harm, outside any network like this one.
Sources and evidence
What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.
In A.M.C. v. Smith (No. 3:20-cv-00240, M.D. Tenn.), a federal court held after a five-day bench trial that Tennessee's Deloitte-built TEDS automated Medicaid eligibility system, operational statewide since March 19, 2019 for a program covering roughly 1.7 million residents, produced wrongful terminations, wrong-household assignments, and misleading or missing notices that violated the Medicaid Act, the Fourteenth Amendment's Due Process Clause, and the Americans with Disabilities Act; the 116-page opinion, issued August 26, 2024 by Judge Waverly D. Crenshaw Jr., ordered mediation before considering an injunction.
empirical- Trade press StateScoop (Keely Quinlan), Automated Medicaid system contributed to thousands losing health care coverage (2024) https://statescoop.com/tenncare-automated-medicaid-healthcare-coverage-2024/
- Trade press Stotler Hayes Group LLC (Erin Sailor), Holding State Medicaid Agencies Accountable: A Federal Court Issues Ruling on Deficiencies and Discrimination in TennCare (2024) https://stotlerhayes.com/holding-state-medicaid-agencies-accountable-a-federal-court-issues-ruling-on-deficiencies-and-discrimination-in-tenncare/
- Academic Georgetown University Center for Children and Families (Leonardo Cuello), Federal Judge in Tennessee Sides with Individuals Terminated from Medicaid (2024) https://ccf.georgetown.edu/2024/09/06/federal-judge-in-tennessee-sides-with-individuals-terminated-from-medicaid-finds-numerous-violations-in-tennessee-medicaid-eligibility-process/
- Advocacy National Health Law Program, Major Litigation Win: Court Rules Tennessee's Medicaid Program Wrongfully Denied Health Care for Thousands (2024) https://healthlaw.org/news/major-litigation-win-court-rules-tennessees-medicaid-program-wrongfully-denied-health-care-for-thousands/
Where this connects
Institutional pressures in this domain
- Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
- Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
- Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
- Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.
All of them in context on the Public benefits & eligibility domain page.
Levers available here and the patterns behind them
- Understand the system — Understand the system
- Check copied records — Reconcile copied records
- Assign a challenger — Structured dissent
- Review on schedule — Oversight cadence & retrospectives
- Require sign-off — Conformity assessment gate
- Gate vendor updates — Vendor quality gate
- Pause AI on alarms — Deployment circuit-breaker
- Mark AI-written records — Provenance labeling
- Upgrade model — Improve the model
- Gate record entries — Human-in-the-loop write gating
- Vet connections — Connection authorization
- Escalate checks — State-feedback vigilance
Documented case histories
- Tennessee TennCare TEDS
- Michigan MiDAS
- Robodebt (Australia)
- Indiana / IBM eligibility modernization
- Rotterdam welfare-fraud risk model
- Arkansas ARChoices / ARIA
- Netherlands childcare-benefits scandal (Toeslagenaffaire)
- SyRI (Netherlands)
- CNAF benefit-fraud risk score (France)
- Forsakringskassan VAB fraud-selection profile (Sweden)
- Udbetaling Danmark data-driven control (Denmark)
- BOSCO (Spain)
- Serbia Social Card (Socijalna karta)
- UK DWP Universal Credit Advances fraud model
- ID.me identity verification as an unemployment eligibility gate
- Medicaid unwinding: automated ex parte renewal at population scale
- INSS auto-analysis: when the productivity metric makes denial the fastest way out
- Samagra Vedika
- Workforce Australia Targeted Compliance Framework: automated payment sanctioning after Robodebt
- NYC MyCity business chatbot
- Nevada DETR generative-AI unemployment appeals