Who Writes the Rules: Statute, Rules, the State Plan and Waivers

An Idaho resident who asks "who decided this?" about a Medicaid change can get four different true answers in one afternoon. Congress decided it. The Legislature decided it. The Department of Health and Welfare decided it. The federal Centers for Medicare & Medicaid Services (CMS) approved it. Each answer is accurate because the program is built in layers, and each layer has its own author, its own paper trail and its own rules about who gets to comment. This lesson maps those layers so you can find the one that actually controls the question in front of you.

The lesson matters most to people who write or speak in public. A reporter who credits the wrong body for a change, a candidate who promises to fix a rule that is really a federal statute, or an advocate who files a comment after the window closed all lose credibility fast. Reading the layers correctly lets you aim at the decision maker who can actually move.

Five layers, one program

Medicaid is a joint program under Title XIX of the Social Security Act, passed in 1965. The federal government sets the outer limits and pays part of the bill. Each state runs its own program inside those limits and pays the rest. That sentence hides a pile of documents, and the pile has an order.

The arrows point down because authority flows down. A DHW rule cannot contradict Idaho Code. Idaho Code cannot contradict the federal statute where the federal statute applies to a state that takes the federal money. A waiver can change how a state follows certain federal requirements, but only the ones the statute lets the Secretary of Health and Human Services waive, and the work requirement is not one of them. Text further down covers that exception.

Layer	Who writes it	Where to read it	How it changes
Federal statute	Congress, signed by the President	uscode.house.gov, law.cornell.edu, congress.gov	New law, such as Public Law 119-21 (July 4, 2025)
Federal regulation	CMS, for the Secretary	ecfr.gov (42 CFR Parts 430 to 460) and federalregister.gov	Proposed rule, comments, final rule; or an interim final rule
State plan	Idaho DHW, approved by CMS	medicaid.gov state plan amendment pages	State plan amendment (SPA)
Waivers	Idaho DHW, approved by CMS	medicaid.gov demonstration and waiver list	Application, amendment or renewal
Idaho Code	Legislature and governor, or voters	legislature.idaho.gov/statutesrules	Bill or initiative
IDAPA rules	Idaho DHW	adminrules.idaho.gov	Notice of rulemaking, comments, legislative review

Layer one: federal law and federal regulations

The statute

The master text is Title XIX of the Social Security Act, codified at 42 U.S.C. 1396 and following. The long section most people end up in is 42 U.S.C. 1396a, which lists what a state plan must contain. Subsection (a) is a numbered list that runs to item 90, and the lettered subsections after it (such as (e)(14) on income counted by modified adjusted gross income) hold special rules. When a news story says "Section 1902," it is using the Social Security Act numbering. Section 1902 of the Act is section 1396a of Title 42. The two numbers name the same text, and both appear in sources you will read.

The work requirement is Section 1902(xx), which is 42 U.S.C. 1396a(xx). Congress added it in Public Law 119-21, signed July 4, 2025. Paragraph (10) of that subsection says that, notwithstanding the general waiver power in section 1315, the provisions of the subsection may not be waived. That is as close to a stop sign as the statute has. A state cannot ask for a section 1115 waiver to skip it. The only relief valve is a good-faith extension in paragraph (11), which the statute lets the Secretary grant until no later than December 31, 2028.

The regulations

CMS turns statutes into regulations in Title 42 of the Code of Federal Regulations. Parts you will meet: Part 430 (grants to states and the state plan process), Part 431 (state organization, including fair hearings in subpart E and demonstration comment rules in subpart G), Part 435 (eligibility), and Part 438 (managed care). The regulation text lives at ecfr.gov, and each change is published first in the Federal Register.

The work requirement shows how this works. On June 3, 2026, CMS published an interim final rule titled "Medicaid Program; Community Engagement Requirement for Certain Individuals" (CMS-2454-IFC, 91 Fed. Reg. 33348). It took effect July 31, 2026, the same day comments were due. Its regulatory text adds a new subpart F to 42 CFR Part 435, with sections 435.550 through 435.563 covering who is subject, how to show compliance, how states verify, what a noncompliance notice must say and how a state asks for a good-faith delay. A correction followed on June 29, 2026. "Interim final" means the rule is already in force while CMS reads comments. Lesson 6 walks through the content.

The cost of reading the wrong version

Federal texts change quietly. The Cornell Legal Information Institute and the Government Publishing Office both publish the U.S. Code, but their editions lag Congress by different amounts. When this lesson was prepared, the 2024 edition of Title 42 at govinfo.gov did not contain subsection (xx) at all because it did not yet exist, while the Cornell page carried it. Check the date on any edition of the Code you cite. For regulations, the eCFR shows an "up to date as of" date at the top of each section. Put that date in your notes.

Layer two: the Medicaid state plan

A state plan is a contract-like document in which a state tells CMS how it will run the program. Federal regulation 42 CFR 430.12 calls it a standardized template that CMS issues and updates, part basic federal requirements and part the state's own choices. The regulation requires the plan to be amended whenever federal law, regulations, policy interpretations or court decisions change, and whenever Idaho makes a material change in its own law, organization or policy.

Two procedural facts help in practice:

• The Medicaid agency must send plan amendments to the governor or the governor's designee for review and comment before they go to the CMS regional office (42 CFR 430.12). Any governor comments go to CMS with the amendment.
• CMS has 90 days after an amendment reaches its regional office to act. If CMS sends neither a written disapproval nor a written request for more information within that period, the amendment is treated as approved. A request for more information restarts the 90 days when CMS receives the answer (42 CFR 430.16).

That second rule gives reporters a useful clock. If DHW says an amendment is "pending at CMS," ask for the date it was submitted and whether CMS has asked questions. The submission date plus 90 days is the earliest default deadline, and a questions letter resets it.

Idaho's approved plan and the amendments in progress are listed on medicaid.gov under state plan amendments, searchable by state. The pages show a transmittal number, an effective date and, usually, the text. In the Idaho context, the state plan is where the eligibility groups live, including the adult expansion group that Proposition 2 required Idaho to add. Lesson 2 covers how that happened, and Idaho Code 56-267 tells DHW to amend the plan and submit the amendments to CMS within 90 days.

Layer three: waivers

A waiver lets a state do something different from the default federal rules for certain parts of the program. People often use the word loosely. The three that matter in Idaho have different legal sources, different purposes and different public processes.

Type	Federal source	What it does	Idaho examples listed on medicaid.gov in October 2026
Section 1115 demonstration	Social Security Act 1115, 42 U.S.C. 1315	Tests a policy that departs from federal rules, for a set period, if CMS finds it likely to promote Medicaid's objectives	Pending: Idaho Behavioral Health Transformation; Idaho Family Planning Referrals; Idaho Medicaid Reform Waiver. Expired: Idaho Childless Adults; Idaho Children's Access Card
Section 1915(b) waiver	Social Security Act 1915(b)	Lets a state require enrollment in managed care or limit provider choice	Idaho Behavioral Health (ID-02); Dental Smiles (ID-03); Idaho Medicaid Plus (ID-04)
Section 1915(c) waiver	Social Security Act 1915(c)	Pays for home and community-based services for people who would otherwise need facility care	ID Adult Developmental Disabilities Waiver (0076.R07.00); ID Aged and Disabled Waiver (1076.R07.00)

The medicaid.gov list also shows two older 1915(c) entries, the Act Early Waiver and the Children's Developmental Disabilities Waiver, labeled as terminated. Those names appear in older Idaho material, so a source that still describes three waivers is out of date. The control numbers matter if you file a public records request or search CMS: the digits before the first period identify the waiver and the "R07.00" part is the renewal and amendment number.

Why the three types differ

A 1915(c) waiver is a service program. It exists so someone with a developmental disability or an age-related need can live at home. The money still flows through Medicaid, but the state can cap the number of slots, which is why some people wait for services. A 1915(b) waiver is a delivery-system tool. Idaho used it for the behavioral health plan (the Idaho Behavioral Health Plan managed by a contractor), for dental benefits and for Medicaid Plus. A section 1115 demonstration is the broadest tool and the most political. States have used it for work requirements, premium rules and coverage experiments, and the federal government must find that the experiment promotes the objectives of the program.

The work requirement closes one door in this layer. Before Public Law 119-21, a state wanting work rules had to ask for a section 1115 waiver, and CMS decided case by case. Idaho asked in 2019 after the Senate Bill 1204 directive, and Idaho did not receive federal approval for that request. Under the current statute, 42 U.S.C. 1396a(xx)(10) says the provisions may not be waived, so the rule applies to expansion adults in every expansion state on the federal schedule regardless of a waiver. Idaho's remaining choices concern implementation details; the requirement itself is settled.

Legislative approval of Idaho waivers

Idaho has added a state check on top of the federal process. Idaho Code 56-2201 says DHW shall not seek or implement a Medicaid state plan amendment or a section 1115 or 1915 waiver that would expand coverage to additional people or classes of people, or increase any net cost to the state, without first obtaining approval from the Legislature. The approval must be given in statute and, to be effective, must be listed in Chapter 22 of Title 56. The section does not reach amendments or waivers already authorized by statute or implemented as of July 1, 2025, and it does not apply to changes that neither expand coverage nor raise net state cost. It also requires DHW to give regular updates to the Medicaid Legislative Review Panel and to seek the panel's input on the design of any waiver sent to CMS.

That section has a short history that trips people up. An earlier version, Idaho Code 56-270, was added by House Bill 398 in 2024 (2024 Session Laws chapter 288). House Bill 345 of 2025 repealed it in its first section and replaced it with the new Chapter 22. A page for the old section still loads on legislature.idaho.gov under the number 56-272, with the 2024 history line. If your notes cite 56-270 or 56-272 for the legislative-approval rule, update the citation to 56-2201.

Layer four: Idaho Code, Title 56

Idaho's Medicaid statutes sit mainly in Title 56 (Public Assistance and Welfare). Chapter 2 is the Public Assistance Law, with sections including 56-263 and 56-265 (both amended by House Bill 345 in 2025), 56-267 (expansion) and 56-274 (the review panel). Chapter 22 holds the legislative-approval provisions. Chapter 14 holds the hospital assessment, the fee on hospitals that the state uses to draw federal matching money, which lesson 5 covers.

Idaho Code 56-267: the section voters wrote

Section 56-267 began as Initiative Measure No. 2, approved by voters in November 2018, and the Legislature has amended it since. As of October 2026 its numbered subsections do the following, in plain terms:

1. Directs DHW to amend the state plan to cover people under 65 with modified adjusted gross income at or below 133 percent of the federal poverty level who are not otherwise eligible.
2. Requires plan amendments to go to CMS within 90 days.
3. Says eligibility cannot be delayed by waiver discussions, and bars a waiver that lowers federal funding for the group below the 90 percent commitment.
4. Requires the Legislature to declare the section void if the U.S. Supreme Court finds the 90 percent provision (Social Security Act 1905(y)) unlawful.
5. Sends the House and Senate health and welfare committees a review job if federal funding falls below 90 percent, and lets DHW offset added state cost between sessions.
6. Adds the community engagement rules: by December 31, 2026, DHW must implement the requirements of 42 U.S.C. 1396a(xx), new applicants must show compliance for the three consecutive months before applying, and DHW must disenroll current enrollees who cannot show compliance.

The amendment history on the section page lists the 2019 session law (chapter 318), 2025 chapters 118 and 192, and 2026 chapter 334, which was House Bill 913. That history is the quickest way to learn how many times the Legislature has touched a voter-approved law. It is also the place to check before repeating a claim like "the initiative says X," because several of the current words are the Legislature's.

The 133 percent figure in the statute and the 138 percent figure that DHW and news stories use are the same line. Federal rules disregard 5 percentage points of income in determining eligibility for this group, so the effective cutoff is 138 percent of the poverty level. Lesson 3 gives dollar amounts.

Chapter 22: a list of permissions

Chapter 22 is unusual. It works like a ledger of what the Legislature has already approved, so a new waiver can only start once the Legislature adds it to the list. The sections in force when this lesson was prepared:

Section	Subject	What it directs
56-2201	Legislative approval required	Blocks coverage-expanding or cost-raising SPAs and waivers without a statute listed in the chapter
56-2202	Rural emergency hospitals	Submit an SPA recognizing and paying for the rural emergency hospital designation
56-2203	Cost-sharing	Begin the application for a cost-sharing SPA no later than July 1, 2026
56-2204	Comprehensive managed care	Submit the SPAs and waivers no later than July 1, 2027 (amended by the 2026 health and human services appropriation act, chapter 271)
56-2205	Expansion limits	Work requirement of 20 hours per week, an exchange tax credit option, biannual redetermination and benefit limits
56-2206	Practice authority protection	Submit an SPA by July 1, 2025
56-2207	Site-neutral payments	Submit an SPA by July 1, 2026
56-2208	Scope-of-service rate changes	Adjust clinic encounter rates for qualifying changes, with deadlines in the section

Look closely at 56-2205 and you will find a good example of layers disagreeing. It describes a state work requirement of 20 hours per week, averaged monthly, with a set of exemptions that includes parents of children under six. Congress later set a federal rule of 80 hours per month, with a different exemption list that covers parents or caretakers of a child 13 or younger. The chapter read at legislature.idaho.gov in October 2026 shows no amendment to 56-2205 since it was added in 2025. Where the two lists differ, the federal statute controls. That is the practical reason the Legislature passed House Bill 913 in 2026 to add the federal requirements by reference into 56-267. The older 56-2205 language remains on the books, and a careful reader will say so.

The review panel

Idaho Code 56-274 creates the Medicaid Legislative Review Panel. The co-chairs are the chairs of the House and Senate health and welfare committees. The Speaker of the House and the Senate President Pro Tempore appoint the other members, with at least one senator and one representative from the minority caucus. The Legislative Services Office staffs it. The panel meets at the co-chairs' direction to review Medicaid-related contracts, recommends key indicators, performance measures and data to be collected under those contracts, does other work assigned by the Legislature, the Legislative Council or the co-chairs, and reports its activities and recommendations to the Legislative Council.

The section began as 56-270 in 2024 (session law chapter 149) and was redesignated 56-274 in 2025 (chapter 211). The panel does not pass laws or approve rules. It is an advisory group with access to DHW, and its meetings are where managed care design decisions get previewed. Lesson 7 follows that work, and lesson 10 explains how to testify. If a news story says "lawmakers approved" something that the panel only reviewed, the story overstates what happened.

Layer five: IDAPA 16.03 and how Idaho rules are made

IDAPA stands for the Idaho Administrative Procedure Act, but the abbreviation is also used for the rules themselves, which agencies write to carry out statutes. The Department of Health and Welfare is Title 16 of the IDAPA numbering. The 16.03 series is the Medicaid and related eligibility group of chapters. Numbers read in order: department (16), division group (03), chapter. The chapter titles I could confirm on the adminrules.idaho.gov index in October 2026 included 16.03.01, "Eligibility for Health Care Assistance for Families and Children," and 16.03.05, "Eligibility for Aid to the Aged, Blind, and Disabled." The index page also listed chapters for food assistance, TAFI cash assistance, certified family homes, developmental disabilities agencies and assisted living. The site displayed a technical-issue notice the day I read it, so treat any list as a prompt to open the live index and check it.

The chapters on benefits are the ones most affected by 2025 legislation. Sections 9 through 12 of House Bill 345 declared the following rules "null, void, and of no force and effect" on and after July 1, 2025:

• IDAPA 16.03.17, relating to Medicare/Medicaid Coordinated Plan Benefits;
• IDAPA 16.03.18, relating to Medicaid Cost-Sharing;
• IDAPA 16.03.09, relating to Medicaid Basic Plan Benefits;
• IDAPA 16.03.10, relating to Medicaid Enhanced Plan Benefits.

I could not confirm what replaced those chapters, so ask DHW rules staff which temporary or pending rules currently govern basic and enhanced plan benefits before you cite either chapter. This is the practical lesson: an old PDF of IDAPA 16.03.09 is history, and the date on a rule matters as much as its number.

How a rule gets made

Agencies publish proposed rules in the Idaho Administrative Bulletin. Idaho Code 67-5222 sets the public part:

• The agency must accept written or oral comments for at least 21 days after the notice is published in the bulletin.
• For a substantive rule, the agency must hold an oral presentation if 25 persons, a political subdivision or an agency ask in writing. The request is due within 14 days after the notice is published, or within 14 days before the comment period ends, whichever is later.
• No oral presentation is required when the agency has no discretion over the substance because a court order or an amended statute or federal rule dictates it.
• Every agency must allow oral presentations by video conference or telephone, and from July 1, 2026, an agency must post a recording of an oral presentation or public hearing on a rule within 15 days and keep it at least three years.

Idaho Code 67-5226 allows temporary rules, which take effect before the public process finishes. The governor must find that one of the listed conditions applies, including an imminent threat to public health, a need to meet a deadline in amended law, a reduction in regulatory burden, protection of citizens' rights or a natural disaster. The statute says temporary rules should be used only in emergencies or other limited situations. They are published in the next available bulletin issue, and the agency must start the normal process as soon as reasonably possible unless the temporary rule will expire first.

The Legislature gets a second look under Idaho Code 67-5291. A germane standing committee reviews any temporary, pending or final rule in its subject area and checks whether it is consistent with the legislative intent of the statute it carries out. The Legislature can approve or reject a rule by concurrent resolution, in whole or in part, but a rejection requires findings that explain how the rule conflicts with the authority or requirements of the enabling statute. Unapproved temporary rules expire on their own terms or at the end of the next regular session, whichever comes first. Pending rules approved by concurrent resolution take effect July 1 of that session year unless the resolution says otherwise. For a full walk through the process, see the Laws and Rules course on Idaho administrative rules.

Section 1115 comment rules in detail

Because section 1115 proposals are the most contested, the process is worth knowing step by step. The state-level rule is 42 CFR 431.408. Before submitting a new demonstration application or an extension of an existing one, a state must provide at least a 30-day public notice and comment period. The state must hold at least two public hearings on separate dates at separate locations, and at least one must use a telephone or web conference unless the state documents that people statewide had another way to comment. The hearings must take place at least 20 days before the application goes to CMS.

The notice has to be detailed enough for meaningful comment. It must describe program goals and the people affected, the proposed delivery system, eligibility, benefits and cost sharing and how these differ from current features, estimated enrollment and spending changes with a financial analysis, the hypothesis and evaluation plan, the waiver authorities requested, where the application can be read, and the addresses for comments. The state must post all of this on a prominent agency website and publish a shorter notice either in its administrative record or in the newspapers of largest circulation in cities of 100,000 or more, at least 30 days before submission. If the demonstration directly affects Indians, tribes, Indian health programs or urban Indian health organizations, the state must consult them before submission and document the consultation.

After the state files, CMS runs its own process under 42 CFR 431.416. CMS notifies the state within 15 days that the application is complete and opens a 30-day federal comment period, posts the application and the comments on its website, and makes no final decision until at least 45 days after the notice of receipt, except in emergencies such as natural disasters. CMS reviews comments by the deadline but does not respond to them one by one, and late comments may not be considered. A good comment cites the specific page of the application and asks for a specific change.

Notice what the rules leave out. Nothing in the federal comment process for demonstrations requires the state to change anything because of what commenters say. The record matters for what comes next: a federal lawsuit, an oversight letter, a legislative hearing or a news story. Comments written to be quoted in those places do more work than a general statement of opposition.

Tracing one rule down the layers

Each layer holds a different kind of choice. Congress picked the outline. The Legislature, through House Bill 913, picked the lookback length (three months, the federal maximum). DHW picks the documents it accepts, the data sources it checks and the wording of its letters, subject to the federal rule that it must check available data first. If you want to change something, aim at the layer where the choice sits.

What each layer lets you do

Different layers answer different questions. Use this table as a routing guide.

You want to know	Start with	Backup source
Whether Idaho can ask for an exemption from a federal rule	The statute: does it say "may not be waived"?	42 CFR Part 431 subpart G for 1115 process
Who is covered and at what income	Idaho Code 56-267 and the state plan	DHW eligibility pages and the current IDAPA chapter
How long CMS can sit on a request	42 CFR 430.16	medicaid.gov SPA listing for the submission date
Which Idaho waivers exist	medicaid.gov demonstration and waiver list	DHW waiver pages
Whether a rule is in force	adminrules.idaho.gov, current rules, with dates	Bulletin notices and legislative concurrent resolutions
What lawmakers actually approved	The bill page, the statement of purpose and the session law chapter	Committee minutes

Where the public fits

Every layer has an entry point, but they differ in how open and how timely they are.

• Federal rules. Comments at regulations.gov during the period listed in the Federal Register notice. For interim final rules such as CMS-2454-IFC, the comment period ran to July 31, 2026, so the chance to comment has passed, but your comments on later rules and your letters to Idaho's congressional delegation about statutory changes are still open.
• State plan. No general federal comment period applies to a state plan amendment that I could confirm. Idaho's legislative panel and public bill hearings are the practical place to raise issues before DHW submits one.
• Waivers. The state-level 30-day notice with two hearings, then the 30-day federal period.
• Idaho Code. Testimony at the House and Senate health and welfare committees, and at the Joint Finance-Appropriations Committee, which controls the budget bills. The Testifying course covers committee rules.
• Idaho rules. The 21-day comment period and the oral presentation request described above. See also Laws and Rules, lesson 9 on testimony and comments.
• Initiatives. Voters can write Idaho Code directly, as they did in 2018. See the Laws and Rules lesson on initiatives and the Idaho Constitution lesson on the people's reserved power.

For the mechanics of how a bill becomes Idaho law, read Laws and Rules, lesson 2 and lesson 6 on federal laws and rules. The Idaho Constitution rules on how a bill must be written, including the single-subject requirement, are in lesson 5 of that course. House Bill 345 had a title long enough to fill most of a printed page, and the title requirement is the reason.

Mistakes that repeat

Calling a state plan amendment a waiver

An SPA changes the standing plan. A waiver sets up an exception or experiment. Coverage groups, for example, normally change by amendment. A news story that says Idaho "asked for a waiver" to change a rate has probably confused the two, and the difference matters because the comment rules differ.

Treating a bill as a rule

Bills become Idaho Code. Rules come from agencies. Only the Legislature can pass a bill, and only an agency can adopt a rule (the Legislature can reject one by concurrent resolution). "Lawmakers passed a rule" is a red flag.

Quoting a repealed number

The case of 56-270, now 56-2201, and the four IDAPA chapters voided by House Bill 345 show how citations rot. Treat any citation older than a session as unconfirmed until you open the live page.

Ignoring dates on effective and implementation

Federal law set the work requirement to begin no later than the first day of the first quarter that begins after December 31, 2026, which is January 1, 2027. Idaho Code 56-267 says December 31, 2026 for implementation. DHW says it will review people whose coverage periods end on or after January 1, 2027. All three dates describe real steps. Pick the one that matches your sentence.

A practice trace

Take a claim you can check this week. In 2026 the Legislature passed House Bill 863, which cut residential habilitation provider rates. Ask which layer holds the decision. The bill page shows a House Health and Welfare Committee sponsorship, a House vote of 60 to 8 (2 absent or not voting) on March 12, a Senate vote of 19 to 15 (1 absent or not voting) on March 23, a governor's signature on March 26, 2026 and session law chapter 161. That is a state statute layer decision, and it ties to an appropriation in a separate bill. Rates paid under the plan are also described in plan documents, so check medicaid.gov for a matching amendment and its dates. Lesson 5 follows the money side of this same bill. Your assignment is to write down, for any one Medicaid change in the news this month, the layer that holds the decision, the date it took effect and the document where a reader can see it.

When you finish a trace, post the chain in a short list with links. A reader who sees the federal section, the Idaho Code section, the rule chapter and the date can verify every step in five minutes, and a reader who can verify tends to trust what you write.