Key Takeaways
- HHS launched the AERO initiative on May 21, using AI to re-score at least five years of Single Audit Act compliance data for federally funded entities receiving more than $1 million annually. Hospitals receiving Medicaid, NIH, HRSA or pandemic-relief funding are directly affected.
- AERO findings can trigger payment withholding, cost disallowances, award suspensions and debarment proceedings with immediate financial and reputational consequences for hospitals.
- Hospitals should file a FOIA request before responding to any AERO correspondence to seek the AI methodology, validation studies and federal approval records. Early FOIA requests may help build the administrative record and expose weaknesses in potential enforcement actions.
On May 21, 2026, the U.S. Department of Health and Human Services launched AERO — the Audit Enforcement and Risk Oversight initiative. Using artificial intelligence, HHS is now re-scoring at least five years of Single Audit Act compliance data for every entity receiving one million dollars or more in annual federal funds. For hospitals, the exposure is substantial and immediate.
What AERO Means for Your Hospital
Hospitals are primary targets. If HHS is your cognizant federal agency — which it typically is for institutions receiving Medicaid Disproportionate Share Hospital payments, Graduate Medical Education funding, NIH and HRSA grants, or COVID and ARPA relief funds — you are squarely in scope. Even hospitals in full compliance face risk: AERO findings against a state Medicaid agency can flow downstream to hospital subrecipients who had no involvement in the underlying audit deficiency.
HHS’s enforcement arsenal is significant. AERO findings can trigger payment withholding, cost disallowances, suspension or termination of awards, and debarment proceedings under 2 CFR Part 180. These are not preliminary inquiries — they carry immediate financial and reputational consequences.
The Legal Problem With AERO
AERO was announced through a press release and letters to governors — not through the notice-and-comment rulemaking that the Administrative Procedure Act requires. No hospital had the opportunity to review the AI’s methodology, challenge its assumptions, or comment before it will be applied to years of historical compliance data. That procedural shortcut is legally significant and potentially fatal to HHS’s enforcement actions.
The AI driving AERO is currently a black box. Grantees are being told what the algorithm concluded — not why, not how, and not on what data. Under the APA’s arbitrary and capricious standard, an AI finding alone is unlikely to be a reasoned agency determination under APA standards. Courts have consistently held that agencies must articulate a rational, non-algorithmic basis for enforcement actions. An opaque AI output has never been legally found to satisfy that requirement.
Critically, HHS’s own published standards — its Plan for Promoting Responsible Use of AI in Public Benefits Administration and its Trustworthy AI Playbook — require bias testing, human oversight, transparency, and OMB pre-clearance before deploying rights-impacting AI. There is no public evidence AERO met any of these requirements. That is the government’s own playbook, and its own program certainly appears to fails it.
The Single Most Important Step You Can Take Now: File a FOIA Request
Before you respond to any AERO correspondence, file a Freedom of Information Act request demanding disclosure of AERO’s AI methodology, training data, validation studies, bias assessments, and OMB M-24-10 pre-clearance documentation. This is not a defensive measure — it is an offensive one. FOIA disclosures populate the administrative record for APA litigation, may reveal methodological flaws that undermine specific findings, and establish a record of HHS’s transparency obligations and failures. Courts in analogous AI enforcement challenges have used FOIA-obtained records as the evidentiary foundation for invalidating agency actions.
We highly recommend filing a FOIA request before responding to any AERO findings, and well before any enforcement action becomes final. We are available to assess your AERO exposure and develop a response strategy tailored to your institution.
