CMS Proposal Would Require Extensive Provider Directory Changes in MA

A proposed rule published October 20, 2026, outlines a framework that would require Medicare Advantage (MA) plans to verify and update their provider directories at least once every 90 days, report an accuracy score to the Centers for Medicare and Medicaid Servies (CMS), and publicly post it on their directories. CMS says the proposed changes will improve data connectivity and accuracy in provider directories across the health care system. 

The proposed rule implements the requirements in the Consolidated Appropriations Act (CAA) of 2026, known as the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act (the Act). Federal and state regulators, as well as plaintiffs, have been increasingly focused on provider directory inaccuracies and “ghost networks.” Commercial health plans have been subject to directory verification and content requirements for several years. The Act and the proposed rule extend some of those requirements to MA organizations and include numerous additional requirements that appear to reflect what Congress and regulators may have perceived as limitations in the commercial plan framework. The Act and proposed rule could lead to heightened scrutiny on network issues in the MA space and could potentially be used as a roadmap for Congress or the U.S. Departments of Health and Human Services (HHS), Treasury (USDT), and Labor (DOL) to expand the directory requirements applicable to commercial health plans. 

MA Provider Directory Accuracy Requirements  

The Act establishes new provider directory accuracy and accountability requirements for MA organizations beginning in contract year 2028. In large part, the proposed rule mirrors and adds additional color to these requirements. The new requirements also create some consistency for health plans that offer both commercial and MA lines of business. Specifically, the statute includes certain of those requirements drawn from the federal provider directory statute applicable to commercial plans (42 U.S.C. section 300gg-15), which took effect in 2022. However, the proposed rule takes those requirements a significant step further. Notably, no implementing regulations were ever promulgated for the commercial directory statute. As a result, commercial plans have been required to engage in good faith efforts to comply based on the statute alone. Congress and regulators have had several years to evaluate and refine the framework set forth for commercial plans.  

Together, the Act and proposed rule would require:  

• More frequent verification: Consistent with the commercial directory statute and the Act, MA plans will be required to verify provider directory information at least every 90 days, instead of the current annual attestation requirement. Notably, however, providers are not removed from the directory if they do not attest (as is the case with commercial directories) and instead will receive an “unable-to-verify" flag in the directory. Additionally, the Act and proposed rule state that physical and online directories should be updated within 30 days of receiving information requiring update, with the exception that providers must be removed within five business days of a determination that they are no longer participating in the network. Commercial health plans, by contrast, have a two-business-day-update requirement. Additional detail is provided in the proposed rule regarding the methods for verification, and the proposed rule specifies that hospital and facility information must be updated at least every 12 months.  
• Expanded directory content: Several provider directory fields listed in both the Act and proposed rule are not enumerated in the commercial statute, specifically, the primary office or facility address where covered items or services are furnished, whether the provider is accepting new patients, disability accommodations, cultural and linguistic capabilities, and telehealth capabilities. Further, in a new requirement that was not set forth in the Act, MA plans would also have to disclose whether a listed provider is under common ownership or control with the MA organization — a disclosure not currently required for any plans under federal law.  
• Annual accuracy scoring and public reporting: Under the Act, MA plans will be required to conduct annual accuracy analyses using random samples, calculate weighted accuracy scores, and report those scores to CMS. The proposed rule provides significant additional detail regarding the methodology and process. The accuracy score must account for almost all directory data points, with the exception of provider name, cultural and linguistic capabilities, and common ownership or control disclosure. The Act and proposed rule require that, beginning in contract year 2029, CMS publish these scores publicly in a machine-readable format. MA plans must prominently display the scores in their provider directories. While federal and state regulators have increasingly been requesting information on directory accuracy and secret-shopper audits, this requirement goes beyond any existing federal obligation on commercial plans. The public nature of these scores could be used to fuel additional litigation in the space. 
• New enrollee cost-sharing protections: As with the commercial directory statute, the Act and proposed rule include protections for enrollees who rely on inaccurate provider information. Specifically, if an enrollee schedules an appointment with a provider incorrectly listed as “in-network” when services are delivered, the enrollee's cost sharing would be capped at in-network rates. Notably, the proposed rule goes beyond the protections in the commercial statute or the Act by requiring MA organizations to proactively change cost-sharing rates for members even where the member has not made a request. The proposed rule would require MA plans to maintain daily archived directory records for at least 10 years. They would also need to include language in provider contracts to ensure that plans can receive documentation to verify dates of service. Both the Act and proposed rule continue numerous provisions requiring MA organizations to notify enrollees of this protection.  

What the Proposed Rule May Mean for MA Plans  

The operational requirements could be substantial, particularly for MA organizations that have directories that are not already used for commercial products. Even organizations that already have robust directory processes in place could face new implementation hurdles. MA plans would need to build or significantly upgrade systems to support quarterly verification cycles, daily archiving, and annual accuracy scoring. The public disclosure of accuracy scores introduces a reputational dimension that goes beyond regulatory compliance. MA plans that receive lower scores will face competitive pressure as well as a heightened risk of regulatory investigations and class action lawsuits. The 10-year archiving requirement and the retroactive refund obligation for out-of-network cost-sharing errors also creates long-tail financial exposure that MA organizations will need to account for in their planning. CMS said it expects to release another proposed rule of policy and technical changes for MA and Part D later this fall.