Capstone believes investors should focus on four key regulatory dynamics that separate signal from noise in the RCM landscape. Amid regulatory flux that includes Medicaid work requirements, ACA subsidy expiration, and AI restrictions, RCM vendors face a dramatic moment: hospital financial stress is rising, yet demand for revenue-maximizing technology is intensifying as providers seek to protect margins. Here are the four factors to watch:

• 1) Growth in Uncompensated Care: One Big Beautiful Bill Act (OBBBA) provisions and the expiration of Affordable Care Act (ACA) enhanced premium tax credits (EPTCs) will increase hospitals’ exposure to uncompensated care. However, OBBBA’s stricter Medicaid eligibility requirements, particularly work requirements taking effect January 1, 2027, will drive greater demand for revenue cycle management (RCM) vendors with advanced front-end solutions. Capstone expects eligibility and enrollment solutions to be prioritized in hospital request-for-proposal (RFP) processes.
• 2) RCM Fee Structure, Especially Percent-Based Fees: Many states restrict percent-based fees for healthcare providers, but these restrictions pose limited risk to billing service providers. Most regulations target fee-for-referral arrangements and exempt billing services. New York is the only state with a broad ban on percent-based fee sharing.
• 3) Artificial Intelligence Regulations: Capstone expects state-level AI regulations to continue to omit provider billing applications. While we anticipate continued state-level AI legislation in healthcare billing, emerging regulations are most likely to restrict payor AI use for claims denials and coverage decisions, not provider RCM tools.
• 4) Data Offshoring: RCM vendors generally satisfy data localization requirements by keeping health data in North America while using offshore labor. Regulatory risk lies at the state level. Some states ban offshore work, while others have no restrictions.

1) Growth In Uncompensated Care

Headwinds

The revenue structure of RCM vendors exposes them to risks from policy changes impacting the health of hospitals—their customers. Two impending changes are likely to materially impact hospital health by catalyzing an increase in uncompensated care and reducing supplemental payments.

The OBBBA imposes work requirements on the Medicaid expansion population, places a moratorium on two Biden-era Medicaid eligibility rules intended to ease and maintain enrollment in the program for eligible individuals, and imposes increased eligibility checks, which Capstone projects will result in 6.9 million disenrolled beneficiaries.

In addition to the increase in uncompensated care, hospital budgets are likely to be compressed by OBBBA-imposed restrictions to provider taxes, which allowed states to draw a greater share of federal matching for their Medicaid programs, and restrictions to state-directed payments (SDPs) that allow states to provide supplemental payments to hospitals through managed care arrangements. The increase in uninsured patients, coupled with fewer federal Medicaid dollars, will raise uncompensated care and self-pay rates, threatening hospital revenue and potentially triggering hospital closures, especially in rural areas.

Furthermore, the ACA’s enhanced premium tax credits are set to expire on December 31, 2025, leading to an additional 4.2 million beneficiaries disenrolled from health insurance. Capstone believes there is a 75% probability that legislation to extend EPTCs will be passed before expiration, avoiding the worst-case scenario. No comprehensive solutions have emerged, but we believe any new proposals will lead to some level of disenrollment.

Despite this, Capstone expects Congress to intervene if hospitals face closures and believes financial risks underscore the need for tools with end-to-end billing support, placing greater emphasis on front-end RCM capabilities.

Tailwinds

Capstone expects OBBBA-imposed Medicaid eligibility provisions to drive greater demand for vendors that can help hospitals manage eligibility and enrollment. Given work requirements and shorter redetermination windows, it is increasingly likely that patients will learn they are disenrolled from Medicaid at the point of care, highlighting the importance of RCM services that support front-end functions, such as automated eligibility verification and enrollment.

The onus for the increased administrative burden will be placed on providers at the point of care when these provisions take effect. So, as hospitals wrestle with new requirements, contracting decisions will likely place a greater emphasis on front-end RCM support, leading to higher spending on end-to-end RCM vendors, particularly the high-margin supplementary services.

2) RCM Fee Structure, Especially Percent-Based Fees

Many states have enacted restrictions on percent-based fees, but the bans generally carve out billing service providers. The restrictions are meant to prevent provider-to-provider payments in exchange for referrals, which would violate the Anti-Kickback Statute, and fees for management services that would run afoul of corporate practice of medicine regulations. The Code of Federal Regulations (CFR) 447.10(f) explicitly bans percent-based fees based on the amount billed or collected for Medicaid services when the billing agent is paid directly. Only New York interprets this as a ban on all percent-based fee arrangements for Medicaid claims, while also extending these restrictions generally across all payors. Other states (e.g., Florida) have broad fee-splitting prohibitions targeted at anti-kickback concerns or explicitly carve out billing arrangements in their percent-based fee ban (e.g., California).

3) AI Regulations

Capstone anticipates that states will continue to propose and enact legislation related to AI in healthcare, particularly given the federal government’s reluctance to create an AI regulatory framework. Based on legislative sessions from 2023 to 2025, Capstone expects states to continue considering and passing healthcare billing legislation. However, any restrictions will focus on payor applications, such as AI adverse decision-making in utilization management. We do not expect states to limit providers’ use of AI for billing, coding, or claims management, thereby insulating AI-capable RCM vendors from risk.

If the Trump administration were to intervene, which we think is unlikely, we expect the focus to be on deregulation or a moratorium on state AI regulation. Any moratorium or deregulatory effort that removes restrictions on AI use for adverse utilization management decisions could lead to greater demand for an AI-enabled RCM vendor to combat such decisions.

4) Data Offshoring and Privacy Regulations

Some regulations prohibit the storage of data offshore. There is no federal regulation that wholesale limits or prohibits the storage or access of data offshore. Congress, however, banned data brokers from facilitating the offshoring of, or access to, personally identifiable health information—while allowing de-identified data—in countries considered foreign adversaries. A Justice Department final rule bans bulk US health data, even if de-identified, from being stored in countries designated as “countries of concern,” including China, Russia, and Venezuela. However, many RCM vendors do not store data offshore; rather, they outsource labor offshore while maintaining data in the US or Canada.

Stricter requirements are imposed at the state level. For example, Wisconsin prohibits work involving patient health information from being performed outside the US, Texas requires Managed Care Organizations to provide all services and store all data in the US, and Florida requires electronic health records (EHR) to be stored in the US or Canada. Regulatory specifics vary by state, and some have no limits on data offshoring.