healthcare: state/adjacent no-login matrix + verified-tiers status

- state-healthcare-compliance-opportunities.md: add A/B/C/D no-login
  classification per service (Medicaid, CAQH, payer credentialing, DEA/CSR,
  PDMP, CLIA, license). CLIA (CMS-116 paper) + state CSR reuse the daily batch.
- healthcare-filing-tiers-verified.md: implementation status + TODO-before-live
  (MAC addresses, CMS-10114 filler, migration run, print-mail API phase 2).

docs/healthcare-filing-tiers-verified.md

@@ -97,3 +97,31 @@ human to print & drop. Phase 2: wire a print-mail API (Lob/Click2Mail).
 your State"). Mailing addresses: CMS.gov/Medicare/Provider-Enrollment-and-
 Certification. Need a **state → MAC → mailing-address** table to address envelopes
 + to group the daily batch. `practice_state` intake field drives this.
+
+## Implementation status (built + validated)
+- **mac_routing.py** — state→MAC (56 jurisdictions, 12 destinations) +
+  NPI_ENUMERATOR (Fargo). Addresses marked VERIFY before first live mail.
+- **npi_provider.py** — two-tier `access` strings; NPPES update/reactivation no
+  longer "online-only"; surrogate answer surfaced in the admin todo.
+- **checkout.ts + service pages + intake** — client-facing copy stripped of
+  mechanics; surrogate is the only optional, positively-framed ask (faster,
+  never required, never share password, never mentions paper). Astro build green.
+- **Daily batched mail** — migration 089 (`paper_filing_batches` +
+  `esign_records.paper_batch_id/filing_destination_key`); `batch_cover_sheet.py`
+  (per-agency cover + merged print job); `daily_paper_batch.py` worker
+  (group by destination, self-gated to postal working days); `pw-paper-batch`
+  systemd timer. `test_paper_batch.py` 15/15 pass.
+- **State/adjacent matrix** — A/B/C/D no-login classification added to
+  `state-healthcare-compliance-opportunities.md`; CLIA (CMS-116) + state CSR are
+  the cleanest A-category additions that reuse the daily batch flow.
+
+## TODO before first live mail (manual / verify)
+1. Fill the real MAC provider-enrollment PO Box addresses in `mac_routing.py`
+   (marked VERIFY) from each MAC's current enrollment page.
+2. Confirm CMS-10114 paper-for-changes acceptance + obtain the form PDF, then
+   build `cms10114_pdf_filler.py` for the NPPES Standard path (until then
+   nppes-update falls to surrogate/manual).
+3. Run migration 089 on the DB; confirm the worker picks up a signed test filing
+   and produces the per-agency cover + merged PDF in MinIO.
+4. Phase 2: wire a print-mail API (Lob/Click2Mail) to auto-mail the merged PDF
+   and fill `tracking_number`.

docs/state-healthcare-compliance-opportunities.md

@@ -88,3 +88,34 @@ Credential Upkeep" annual subscription.
   anything that legally must be done by the provider personally (e.g. license
   attestations, DEA personal certifications). Never claim we hold/sign the
   provider's personal license.
+
+## No-login fulfillment classification (per service)
+
+Same two-tier model as Medicare (see `healthcare-filing-tiers-verified.md`):
+**Standard** = we file it, client signs once, no login; **Expedited** = optional
+electronic delegation that speeds us up (never required, never credential
+sharing). Categories:
+- **A** full no-login paper+sign (joins the daily batched-mail flow, grouped by
+  the destination state agency, same as CMS-855 → MAC).
+- **B** public-data, zero client action.
+- **C** needs a one-time signed authorization (an LOA / delegated-official form)
+  but NO client login.
+- **D** genuinely portal/login-bound — flag so marketing never says "no logins".
+
+| Service | Category | Standard (no-login) path | Expedited / delegation | Batched mail? |
+|---|---|---|---|---|
+| State Medicaid enroll/reval | A or D (state-by-state) | Paper enrollment packet → state Medicaid agency where the state still accepts paper; client signs | Where portal-only: client adds us as a **delegated/authorized user** (one signed form, no password) | Yes (per state agency) when paper |
+| CAQH ProView re-attestation | C | n/a (CAQH is online) | Client authorizes our org as **CAQH-authorized administrator** once; we then attest each cycle | No |
+| Commercial payer credentialing | C | n/a (payer portals/CAQH) | One-time **LOA / authorized-rep** per payer; runs off the CAQH grant | No |
+| DEA registration renewal | C/D | DEA renewal is online; the registrant must personally certify | We PREPARE; client e-signs the personal certification (DEA personal cert may not be delegated) | No |
+| State Controlled Substance Reg (CSR) | A (most states) | Paper CSR application/renewal → state agency; client signs | Some states portal-only (D) | Yes (per state agency) when paper |
+| PDMP registration | A/D | Some states paper; many portal | Registration assist | Sometimes |
+| CLIA certificate (CMS-116) | A | **CMS-116 paper → state CLIA agency**; client signs. Biennial renewal. | n/a | Yes (per state CLIA office) |
+| State license renewal + CME | C/D | License renewals are mostly board-portal + personal attestation | We ASSIST (prep + reminders + CME tracking); client does the personal attestation | No |
+
+> Sequencing note: lead the cold-outreach pitch with the **A/B/C** services
+> (genuinely "no logins for you"); for **D**-leaning services, market the relief
+> ("we handle the paperwork") without the "no logins" claim. CLIA (CMS-116 paper
+> to the state) and state CSR are the cleanest A-category additions and slot
+> straight into the existing daily batched-mail flow grouped by state agency —
+> the same machinery built for CMS-855 → MAC.