GAO asked CMS to count assisted-living harm in 2018. Still open

In January 2018, GAO told CMS — in a recommendation it has since designated a priority — to make every state report critical incidents involving Medicaid beneficiaries in assisted living: abuse, neglect, unexplained deaths.▸ Twenty-six states could not produce a count at all. Eight years later, GAO's status ledger⧉ reads "Open — Partially Addressed," with "no additional action reported by the agency" as of March 2026. GAO's new report⧉ shows the counting problem now runs in both directions: the federal government paid at least $12 billion into assisted living facilities in 2024 and cannot say precisely how much, because assisted living is not a consistently identifiable provider type in its own claims data. An estimated one million Americans live in these facilities; more than half are 85 or older.

Four primary documents, read against each other: GAO-26-107884⧉, the new spending-and-coverage report (cover-dated June 2026, released in early July); GAO-18-179⧉, the 2018 oversight report; GAO's live recommendation-status record for it, sealed this week; and CMS's own answer — the Ensuring Access to Medicaid Services final rule⧉ (89 FR 40542, effective July 9, 2024), whose applicability table sets the compliance clock.▸ The 2018 report asked one thing above all: standard, annual, all-state reporting of critical incidents, by incident type and facility type. HHS neither agreed nor disagreed.

GAO identified at least $3.5 billion in federal Medicaid spending⧉ in assisted living facilities in 2024 ($6.2 billion with the state share, for roughly 300,000 beneficiaries — about $23,000 each) and $8.5 billion in traditional Medicare spending across 829,327 beneficiaries.▸ The largest single stream is hospice: $6.1 billion for 294,147 people, nearly $21,000 per beneficiary. Every one of these numbers is a floor. The report's own footnotes show why: in one state, billing guidance told providers to code assisted living as a "custodial care facility" — that code captured $26 million where GAO's standard method saw $280,000, a 93-fold gap from a single coding convention in a single state. Medicare Advantage spending is excluded entirely. What Washington actually spends in the setting is unknown; $12 billion is what could be proven.

An estimated one million Americans lived in assisted-living-type communities in 2022⧉, over half of them 85 or older.▸ Forty-four state Medicaid programs cover services there, 29 of them through waivers that can cap enrollment — 22 of those states maintain prioritization systems for when waiting lists form, and federal Medicaid generally cannot pay the room-and-board that makes the setting affordable in the first place. What the 2018 report established is that the safety net under these residents has no gauge: 26 state Medicaid agencies could not report⧉ how many critical incidents occurred in assisted living — nine couldn't track incidents by provider type, nine had no collection system, five couldn't identify which residents were Medicaid beneficiaries at all. Three states did not count an unexplained death as a critical incident. Fourteen published no incident information anywhere.

The disagreement here is between GAO's clock and CMS's calendar.▸ GAO issued the incident-reporting recommendation in January 2018 and carries it today as a priority recommendation. CMS's response arrived in the April 2024 Access rule — six years later — and the rule's own applicability table defers its force: incident-management-system requirements begin three years after the July 9, 2024 effective date⧉ (2027); the electronic incident-management systems that would make counts auditable, five years after (2029); payment-adequacy provisions, six (2030). GAO's status ledger records what has happened since the rule: CMS developing guidance as of January 2025, and "as of March 2026, there has been no additional action reported by the agency." On CMS's own schedule, the question GAO asked in January 2018 — how many people are being harmed in federally funded assisted living — becomes fully answerable in 2029, when the recommendation turns eleven.

The new report adds the quiet corollary: an oversight system that cannot count incidents also cannot count dollars.▸ The phrase doing the work in GAO-26-107884 is "not a uniformly defined provider type" — there is no standard way to see assisted living in federal claims data, so both the harm ledger and the money ledger are estimates built on state-by-state coding conventions. In 2014, states reported more than $10 billion (federal and state) for 330,000 beneficiaries through more than 130 different programs; a decade later the federal government's visibility into the setting has improved mainly in its precision about what it cannot see.

The compliance dates arrive in sequence: incident-management systems in 2027, electronic systems and their reporting in 2029, payment-adequacy in 2030 — assuming the rule's applicability table holds.▸ GAO says it will assess Recommendation 2 once reporting is actually in effect; Recommendation 3, on timely state reports, remains open with no date attached. The population these systems would watch is growing — the 2018 report noted community residential care was expected to expand, and the new report's waiting-list findings suggest demand already exceeds the waiver slots states fund.