Disposition Codes That Keep Authenticity Findings Reviewable

A reviewer closes two cases ten minutes apart. In the first, the consumer never uploaded anything after two notices. In the second, the consumer uploaded an employer letter whose letterhead the reviewer had already seen on an unrelated application that week, with a signature block that did not match the stated employer. Both cases close as "documentation not provided."

The answer to the problem those two closures create: code completeness and authenticity on two separate axes, retain the original file exactly as received along with its hash, and restrict who may close an authenticity code. Completeness tells you whether the record is sufficient to decide eligibility. Authenticity tells you what you learned about the artifact. One blended code answers the first question and destroys the second.

The cost shows up later, in two places. Your analytics layer cannot count authenticity findings, because they are hiding inside administrative volume. And an investigator who comes back three months later, holding a template that now appears across nine applications, cannot reconstruct what the reviewer saw. The Marketplace verification framework assumes a documented inconsistency record that identifies the inconsistency and the resolution path ^[1]. A disposition that discards the reason does not satisfy that assumption, and forensic practice assumes the original artifact is preserved with an auditable acquisition trail rather than a working copy ^[4].

Why Most Verification Work Is Benign, and Why That Is the Trap

Walk a verification queue and the pattern is obvious. Wrong page of a multi-page document. A phone photo at an angle that cuts off the employer name. A document that expired last year. A pay stub that is genuine but covers a period the eligibility determination does not ask about. These deserve a fast, plainly worded request for a better copy, and nothing more. Treating them as suspicious wastes reviewer time and harms consumers who are trying to comply.

The trouble is that a taxonomy tuned entirely for benign volume prices the authenticity signal at zero. The small share of cases where a document shows alteration indicators, fabricated issuers, or template reuse carries nearly all the referral value in the queue. If the only available codes describe administrative sufficiency, those cases get coded administratively, and the finding evaporates at the moment it was most recoverable.

Throughput pressure makes this structural rather than accidental. As a coverage-termination deadline approaches and leadership asks for the backlog to be drained, the fastest closing code wins. An administrative closure resolves the eligibility question correctly and erases the fraud signal permanently if the original file was not preserved. That is not a reviewer discipline problem. It is an incentive problem built into the code set.

Before you design codes, inventory what your program actually adjudicates and map each category to the evidence standard it must satisfy: identity proofing, annual household income, citizenship and immigration status, and qualifying life events for special enrollment periods, which carry their own documentation expectations ^[2]. Identity dispositions in particular need vocabulary borrowed from identity-proofing guidance, which distinguishes validating the evidence from verifying that the evidence belongs to the person presenting it ^[3]. For the capacity and aging mechanics that sit alongside this, our outstanding-verification queue triage workflow guide covers how to segment by failure mode instead of age alone.

The Two-Lane Disposition Taxonomy

Lane A is completeness. It answers whether the record in front of the reviewer is sufficient to adjudicate the eligibility question. Codes include document missing, wrong document type, unreadable scan, expired document, period not covered, and name or date mismatch within tolerance. Lane A codes are consumer-remediable by design. The correct consumer-facing action is almost always a clear, specific request for the right artifact.

Lane B is authenticity. It answers what the reviewer observed about the artifact itself. Codes include indicators of digital alteration, metadata inconsistent with the stated issuance, template reuse across unrelated applicants, fabricated or unverifiable issuer, and reused employer letterhead. Lane B codes are not consumer-remediable in the same sense, and they are not self-executing. They are findings that enter a case record.

Two hard rules make the taxonomy work. An authenticity concern is never recorded under a completeness code, even when the eligibility outcome is identical. And a completeness gap is never recorded under an authenticity code, because inflating authenticity counts with illegible scans destroys the metric you built the lane to produce. A single case can carry one code from each lane at the same time: a scan can be partly illegible *and* show alteration indicators in the portion that is legible.

What Belongs in a Suspect-Upload Evidence Bundle

Retain the original file exactly as received, plus a hash of that file. Not a re-rendered PDF, not a flattened working copy, not a screenshot a reviewer pasted into a note. Forensic acquisition practice is built on preserving original data with an auditable trail precisely so a later examiner can reproduce the finding rather than take the first reviewer's word for it ^[4].

Then capture the context that makes the artifact interpretable. Which eligibility claim was this document offered to support. Which specific fields the reviewer compared. What baseline the comparison used, whether that was another application's upload, an issuer's published format, or the attestation on the application itself. And the reviewer identity and role, because an authenticity finding is an attributed professional judgment.

Finally, capture the metadata that makes cross-application patterns reconstructable: upload and capture timestamps, submission pathway, and the submitting agent or broker identifier. Indexing uploads by producer rather than solely by application is what turns three unrelated complaints into one producer-level pattern, and CMS requirements for agents and brokers already attach documentation obligations to the producer ^[11].

The closure checklist for an authenticity code

Before any Lane B code may be closed, the record should contain:

• The original file as received, unmodified, with its hash recorded at acquisition
• The eligibility claim the document was offered to support
• The specific fields compared and the comparison baseline used
• The authenticity indicator observed, stated in observable terms
• Upload and capture timestamps and the submission pathway
• The submitting agent, broker, or assister identifier, where one exists
• The reviewer identity and role, and the adjudicator identity if different
• For identity dispositions, which proofing step failed: evidence validation or binding to the applicant ^[3]

That last item matters more than teams expect. A generic "identity failure" is unusable downstream. A synthetic identity typically passes evidence validation and fails binding, so recording which step produced the finding is the difference between a reviewable determination and a coin flip ^[3]. Our guide on referral-grade evidence and audit trails walks through the chain-of-custody detail in more depth.

Writing a Reviewer Note That Survives Later Scrutiny

Describe what is observable in the artifact, not your conclusion about the person. That single rule removes most of the risk in free-text notes. "Consumer submitted a forged letter" is a conclusion about a human being that the note cannot support on its own. "Employer name field shows inconsistent font rendering relative to the surrounding text" is an observation that another reviewer can confirm or dispute by opening the same file.

Structure the note in three labeled lines so a later reader can accept the observation while re-examining the inference.

OBSERVATION: Pay period end date field shows pixel-level edge artifacts
  not present in adjacent fields. Net pay digits use a different glyph
  width than the gross pay digits on the same row.
COMPARISON: Compared against upload on APP-44871 (unrelated household,
  same submitting producer ID), identical template, differing employer
  name only.
INFERENCE: Indicators consistent with digital alteration of amount and
  period fields; template reuse across unrelated applicants.
ACTION: AUT-ALTERED + AUT-TEMPLATE recorded. Routed to authenticity
  adjudication. Original file and hash preserved. No adverse action
  taken at reviewer level.

Keep detection-method narrative out of consumer-facing notices entirely. The consumer receives the standard insufficiency language and the standard opportunity to respond. The method narrative lives in the investigative record, where it belongs, and where it does not teach a submitter which indicator to fix next time.

Who May Close Which Code

Completeness codes should close at the reviewer level, with sampling-based quality review. The volume is high, the judgments are routine, and the right control is a sample read of closed dispositions rather than a second signature on every case. Sample specifically for authenticity language that was coded away, because that is the failure mode this control exists to catch.

Authenticity codes need a named adjudicator and documented human review before any adverse eligibility or coverage action. The point is not ceremony. It is that an authenticity determination asserts something about an artifact that a consumer may contest, that an appeals process may examine, and that a program-integrity referral may rely on. Automated scoring can route and prioritize a case. It should never be the closing authority on an authenticity determination.

Routing rule

on verification_review_complete(case):
    if case.authenticity_indicators is not empty:
        case.lane = "AUTHENTICITY"
        case.exclude_from_throughput_metrics = True
        preserve_original_and_hash(case.uploads)
        route_to(named_adjudicator_pool)
        run_cross_application_pattern_pass(case.linkage_set)
    else:
        case.lane = "COMPLETENESS"
        route_to(standard_reviewer_queue)
        schedule_quality_sample(rate = program_defined)

Excluding authenticity cases from throughput metrics is the load-bearing line. As long as a slow authenticity case counts against a reviewer's closure rate, the code set is fighting the incentive structure and the incentive structure wins.

Then report two separate numbers. Administrative resolution rate tells leadership whether the queue is clearing. Authenticity-finding yield tells leadership whether detection quality is holding. Publishing only the first lets a drained queue be declared a success while findings quietly fall to zero. The agent and broker side of this is covered in our broker consent review checklist, which deals with the documentation that producers must be able to produce for disputed transactions ^[12].

Reopening Closed Cases: An FAQ

Can a completeness closure be reopened when a pattern emerges later? Yes, if the original artifact was preserved. That is the entire argument for the evidence bundle. Without the file as received, a later pattern match has nothing to match against, and the closed case is simply gone as a detection asset.

How do we re-screen closed dispositions without reopening every case? Run the pattern pass against preserved artifacts and identifiers, not against case records. Build re-screening jobs keyed to newly identified templates, employer entities, producer identifiers, and reused Social Security numbers, and surface only the hits for analyst review. Reuse of an identifier across unrelated households is far more informative than any within-application signal, and SSA's inspector general work on number misuse is a useful orientation point for how that misuse presents ^[9]. Our material on synthetic identity and SSN reuse detection covers the linkage mechanics.

What if the eligibility outcome was right but the code was wrong? Correct the code, keep the original entry, and log the reclassification with who made it and why. Overwriting disposition history to look tidy destroys the audit trail that makes the correction credible.

Does an analytic reopen change coverage posture? Treat them as separate actions. A pattern-analysis reopen is an investigative step. Any change to eligibility or coverage runs through the normal verification and notice process, and verification timeframes should be stated only as transcribed from current CMS Marketplace guidance and your state Medicaid agency's primary sources rather than from memory ^[1][5][15].

Who owns the referral decision once a cluster is confirmed? Name that owner in advance. Confirmed clusters typically route to CMS Marketplace program integrity, to state Medicaid program integrity and a Medicaid Fraud Control Unit where Medicaid dollars are implicated, and to the HHS Office of Inspector General through its established reporting channels ^[6][17]. Consumers who report unauthorized activity have their own federal reporting pathway, and that record belongs in the file alongside the producer evidence ^[13].

Start With an Audit of Last Month's Closures

Pull a sample of last month's completeness closures and read the free-text notes for authenticity language. Search the notes for words like fake, altered, same letterhead, matches another application, and does not look right, then check what code the case actually closed under. This takes about half an hour, and it will tell you whether your current taxonomy is losing findings. In most queues I have reviewed, it is.

Then start tracking one number this week: closures carrying an authenticity code, reported separately from total closures. Not as a percentage target, just as a visible count next to the resolution rate. A count that sits at zero while reviewers are writing "same letterhead" in free text is the clearest diagnostic you can get.

Before you add a single new code, add two fields to the disposition record: the hash of the file as received, and the role of the person who closed the case. Codes without preserved artifacts and attributed closures are vocabulary, not evidence.

Go back to the two cases that closed ten minutes apart. Under a two-lane taxonomy, the first closes CMP-MISSING at the reviewer level, with the notice history attached and nothing else needed. The second closes AUT-TEMPLATE plus AUT-ISSUER, adjudicated by a named reviewer, with the original letter and its hash preserved, the comparison application identified, and the submitting producer linked. Same queue, same afternoon, same eligibility consequence. Completely different evidentiary futures. That difference is the only thing standing between a drained queue and a defensible one. For teams building the detection layer underneath these codes, our work on document forensics for fabricated paystubs and SEP letters describes what the reviewer actually sees before the code is chosen.

References

[1] 45 CFR 155.315: Verification process related to eligibility for enrollment in a QHP through the Exchange (eCFR). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-B/part-155/subpart-D/section-155.315

[2] 45 CFR 155.420: Special enrollment periods (eCFR). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-B/part-155/subpart-E/section-155.420

[3] NIST SP 800-63A: Digital Identity Guidelines: Identity Proofing and Enrollment. https://pages.nist.gov/800-63-3/sp800-63a.html

[4] NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response. https://csrc.nist.gov/pubs/sp/800/86/final

[5] CMS Marketplace: Regulations and Guidance. https://www.cms.gov/marketplace/resources/regulations-guidance

[6] HHS Office of Inspector General: Reports and Publications. https://oig.hhs.gov/reports/

[7] GAO: Health Care reports and testimony. https://www.gao.gov/health-care

[8] NIST SP 800-63-4: Digital Identity Guidelines (publication record). https://csrc.nist.gov/pubs/sp/800/63/4/final

[9] Social Security Administration Office of the Inspector General. https://oig.ssa.gov/

[10] GAO: Identity Theft reports and testimony. https://www.gao.gov/identity-theft

[11] CMS: Agents and Brokers in the Health Insurance Marketplaces. https://www.cms.gov/marketplace/agents-brokers

[12] 45 CFR 155.220: Ability of States to permit agents and brokers to assist qualified individuals (eCFR). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-B/part-155/subpart-C/section-155.220

[13] HealthCare.gov: Report fraud or a Marketplace issue. https://www.healthcare.gov/apply-and-enroll/report-fraud/

[14] National Association of Insurance Commissioners: Consumer resources. https://content.naic.org/consumer.htm

[15] Medicaid.gov: Eligibility. https://www.medicaid.gov/medicaid/eligibility

[16] 42 CFR 435.1200: Medicaid agency responsibilities for a coordinated eligibility and enrollment process with other insurance affordability programs (eCFR). https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-435/subpart-M/section-435.1200

[17] Medicaid.gov: Program Integrity. https://www.medicaid.gov/medicaid/program-integrity

[18] GAO: Medicaid reports and testimony. https://www.gao.gov/medicaid