You have probably seen this warning: Medicaid's new work rules are coming, volunteers will need hour logs, and your nonprofit had better build a system. The rule is real. Most of what gets said about it errs toward panic.
Community Service Is One of Seven Ways to Comply
Certain Medicaid enrollees ages 19 to 64, mostly the expansion adult group, must demonstrate community engagement for the months their state assesses. The regulation lists seven ways to do it. Only three count hours: 80 hours of work, of community service, or in a work program. The others are half-time enrollment in an educational program, a combination totaling 80 hours, monthly income at or above the federal minimum wage times 80 hours, and a six-month income average at that level for seasonal workers.
So volunteering is a route, not the route, and for most enrollees it will not be the one.
Many of Your Volunteers Are Not Subject to This at All
Before you worry about records, know who the requirement never reaches. It excludes ten categories outright. Among them: parents, guardians, caretaker relatives and family caregivers of a child 13 or under, or of a disabled person of any age; anyone medically frail; pregnant and postpartum people; veterans with a total disability rating; American Indians and Alaska Natives; former foster youth; people in drug or alcohol treatment; people meeting state TANF requirements; and members of SNAP households not subject to SNAP work rules.
Separate provisions deem others compliant, including anyone under 19, people on Medicare, and anyone released from incarceration in the past three months. States may also elect hardship exceptions for inpatient care, disaster areas, and high-unemployment counties.
That SNAP category matters, because the October SNAP changes moved who sits inside it. A state must apply an exclusion whether or not the person also shows engagement, so an exempt caregiver logging 80 hours is doing work nobody needs.
If Hours Do Count, Your Program Has to Look a Certain Way
Community service means unpaid work, voluntary or court-ordered, with a structured program that directly benefits the community, run under the auspices of public or nonprofit organizations. Training built into the program counts where it builds skills needed for the service itself.
The definition also describes the host. For a volunteer's hours to count, the sponsoring organization has to provide oversight of the activity, and the activity must not serve a partisan purpose. The host also needs a process tracking three things: the type of activity, the dates and hours completed, and a point of contact who can confirm the hours.
Read that third item twice. It implies a human: somebody may need to answer a caseworker's call about February in September.
Two things people get backwards. This is not a 501(c)(3) club, because a state must not restrict community service to 501(c)(3) organizations. And some activity will not count however well you log it: work benefiting only specific individuals, anything purely recreational, and partisan campaigning. If you do voter engagement, that is the line covered in the election rules for 501(c)(3)s.
Your Records Start Doing Real Work in 2028, Not Now
This is the part the panic leaves out. Documentation only enters the picture if the state cannot confirm compliance from data it already holds. When it cannot, the requirement is phased. Before January 1, 2028, a state may require documentation or may accept other information, including the beneficiary's own reasonable explanation. From January 1, 2028, a state must require documentation wherever it is reasonably available. And a state cannot deny or terminate coverage solely because someone cannot produce documentation that does not exist.
Build the habit now because it is cheap and you want it for grant reports anyway, not because a cliff arrives in January.
Nothing Here Is Enforceable Against You
Worth saying plainly: this rule binds the 50 states and the District of Columbia, and it is addressed to state Medicaid agencies. Your nonprofit faces no filing, no audit, no penalty and no liability under it. The tracking language sits inside a definition a state applies when deciding whether hours count.
You are a record, not a referee. States verify at application and renewal, may check more often, and must try their own data first. Failing that, the state sends a notice, treated as received five days after its date, and the individual gets 30 calendar days to show compliance or exclusion. Coverage continues until a determination of ineligibility. Even managed care plans, which can help with outreach, cannot make compliance determinations.
The Start Date Is Not Fixed, and a Court Hears Argument This Month
States must implement for coverage furnished on or after January 1, 2027, unless CMS grants a good faith effort exemption weighing funding, systems and procurement barriers. That runs up to six months initially, with extensions of whatever length CMS sets, and cannot reach past December 31, 2028. A state's real start date can sit two years past the headline one. For people already enrolled, compliance is first checked at their first renewal after that date.
Several states moved the other way, with start dates reported of May 1, 2026 in Nebraska, July 1 in Montana and Arkansas, the latter with enforcement delayed to January 2027, and December 1 in Iowa.
The scale is large. The Congressional Budget Office estimates the provision leaves 5.3 million more people uninsured in 2034, splitting the underlying coverage losses roughly evenly between people who fail the requirement and people who lose coverage over the added steps.
CMS issued this as an interim final rule, so it took legal effect on July 31, 2026, the same day its comment period closed. Georgetown's tracker shows a suit by 25 states and the District of Columbia in which the court denied a preliminary injunction on July 29 and set cross-motions for summary judgment for hearing on October 22. A separate suit filed September 18, Taylor v. Kennedy, challenges how narrowly the rule defines the medically frail exclusion. How either lands turns on arguments nobody can call yet, and this is not legal advice for your situation.
The takeaway
Do the cheap version now. Make sure volunteer sign-ins capture activity type, dates and hours per person rather than a daily headcount, and name the person who can confirm hours when somebody calls. Add a 2028 review to your compliance calendar.
Then stop worrying. Tell volunteers who ask that many people are exempt outright, that their own statement may be enough through 2027, and that the state decides, not you.