Last updated: November 2026
A provider directory accuracy program is the written process a Medicare Advantage (MA) organization uses to verify directory data on a fixed cycle, flag what it cannot verify, remove departed providers within days, and score its own accuracy. CMS proposed rules for all of that on October 20, 2026. The rule is proposed, not final: CMS wants comments by December 15, 2026, and the final text may differ. Integral Healthcare Solutions (IHS) is a consulting firm. It drafts the procedure, scoring workbook, correction log and contract language for your compliance and network staff to approve and run.
This is compliance services work, one of three IHS practice lines alongside accreditation consulting and program development.
What does the proposed provider directory accuracy rule require?
In short, a plan would verify each listed provider at least every 90 days (hospitals and some facilities every 12 months), flag what it cannot verify, remove departed providers within 5 business days, and report an annual accuracy letter grade to CMS. The CMS proposed rule CMS-4214-P, Federal Register, October 20, 2026 (page opened 2026-11-05) would add 42 CFR 422.123 and 422.124 to implement section 6220 of the Consolidated Appropriations Act, 2026, the REAL Health Providers Act. CMS says the Act was enacted February 3, 2026 and takes effect January 1, 2028. Every row below is proposed text.
| Proposed section | What it would require of an MA organization |
|---|---|
| 422.123(b)(1) | Verify each listed provider's directory information at least every 90 days and update the directory if needed. Hospitals and other facilities listed at 422.116(b)(2)(i), (iv) and (v) (acute inpatient hospitals, critical care, surgical services including ambulatory surgery centers): at least every 12 months. |
| 422.123(b)(3) | If a provider cannot be verified during the applicable verification cycle, show a clear indication that the provider's information may not be up to date. |
| 422.123(b)(4) | Put a term in each provider contract obligating the provider to keep directory information current and accurate. |
| 422.123(c) | Update the online and printable directory within at least 30 days of receiving information requiring an update, except that a provider must be removed no later than 5 business days after the plan determines it no longer participates in the network. Send a quarterly addendum to enrollees who requested a printed copy. |
| 422.123(d) | Each year, analyze the accuracy of a random sample of directory records, produce a letter-grade score for each plan, and report it to CMS by the first Monday in April of the following year. |
| 422.124 | If a provider outside the network was listed in the online directory on the date the enrollee made the appointment, and the service would be covered in network, the enrollee owes no more than the lesser of in-network cost sharing or the cost sharing that otherwise applies. |
Who the proposal covers
The duties attach to each MA organization offering a "specified MA plan": network-based plans, and private fee-for-service plans that meet the access standards in 422.114, in whole or in part, through contracts with a network of providers. CMS would exclude non-network regional PPOs that meet access requirements substantially under 422.112(a)(1)(ii) instead of written contracts, and PACE plans (CMS-4214-P, preamble II.B.1).
How the accuracy score would work
The sample would be 65 percent ordinary records and 35 percent records for specialties CMS identifies as high-inaccuracy, now mental health and substance use disorder treatment. An element counts as accurate only if every part is correct. The weights are 40 for network participation status, 20 each for contact information and primary address, 10 for specialty, 3.5 each for disability accommodations and telehealth, and 3 for accepting new patients. A rounded composite of 90 to 100 percent is an A, then B at 80, C at 70, D at 60, E at 50, F at 49 or below. CMS would post the scores in a machine-readable file from contract year 2029.
What applies today
Under 42 CFR 422.111(m), for plan years beginning on or after January 1, 2026, an MA organization must make the provider information described in 422.111(b)(3)(i), including provider addresses and cultural and linguistic capabilities, available to CMS for online publication, update it within 30 days of becoming aware of a change, and attest to its accuracy at least annually. 42 CFR 422.120(b)(1) requires the public directory API to be updated no later than 30 calendar days after the organization receives provider directory information or updates to it. 42 CFR 422.2267(e)(11)(iv) sets 30-day update timing for online and hardcopy directories, which the proposal would move to 422.123(c). Some summaries cite 45 CFR 149.430 as the accuracy rule; it is a balance-billing disclosure rule for providers and facilities. None of these sections contains the 90-day cycle, accuracy score or 5-business-day removal; they appear in the proposal, and CMS says the Act's requirements take effect January 1, 2028 (pages opened 2026-11-05).
Who needs it and what triggers it
MA organizations that offer a specified MA plan need a program if the final rule keeps contract year 2028. The first accuracy report would then be due by the first Monday in April 2029. IHS inference: a process built in 2027 could run a full cycle and a trial sample first.
Provider groups are affected through plan contracts. Plans would add a term obligating providers to keep directory information accurate (422.123(b)(4)) and a term obligating them to supply the earliest date of an enrollee's appointment, surviving contract termination for at least 10 years (422.124(d)). IHS inference, not CMS's words: a group contracting with several plans should expect new contract language and more verification requests. The proposal sets no direct duty on the group; the duty runs through the plan's contract.
CMS says 44.29 percent of the location listings it reviewed (11,360 providers and 18,852 locations at 142 MA organizations, June 2022 to June 2024) had at least one inaccuracy. The review excluded some plan types; the figure describes the sample only. CMS also cites a 2025 HHS Office of Inspector General finding that, on average, 55 percent of behavioral health providers listed in plans' networks did not provide a single service to enrollees in 2023; CMS's passage does not limit that finding to MA plans.
How IHS helps
IHS drafts the written program a plan will operate. Thomas G. Goddard, JD, PhD, leads the work:
- Map each directory element, its source system and its owner against the proposed definition.
- Draft the verification procedure by provider type: the 90-day and 12-month cycles, the method for each element, and what counts as verified.
- Write the outreach schedule so no listed provider falls outside its cycle, and the rule for unverifiable entries.
- Build the correction log, timestamping each network determination and removal so the 5-business-day clock can be shown.
- Draft the sampling and scoring workbook as proposed, the provider contract language for 422.123(b)(4) and 422.124(d), and a vendor oversight plan.
What you supply. Your compliance and network staff run the program and own the provider data and plan decisions. Your counsel advises on how the rule applies to you. To comment on the proposal, IHS can draft text for your review; you file it.
The real limit. IHS drafts to the proposal, marks each provision as proposed, and expects to revise when CMS issues a final rule. IHS does not submit reports to CMS, contact CMS for you, or make your verification calls.
What to have ready
Each item ties to the proposed text, read November 5, 2026; re-check against the final rule.
- An inventory of the nine elements you publish (name, specialty, contact information, primary address, accepting new patients, disability accommodations, cultural and linguistic capabilities, telehealth, common ownership or control disclosure) and the system each comes from.
- The verification method for each element, from CMS's list.
- A written rule for unverified entries: flag wording and clearing step.
- A log of the dates you determined each provider left the network and removed the listing, and of every outreach attempt.
- A dated archive of the online directory: the cost-sharing protection turns on what it showed on the appointment date, and the proposal would require 10 years of retention.
The free introductory call is the next step for turning that list into a program.
How it compares
| Topic | Current rule | Proposed, contract year 2028 |
|---|---|---|
| Update timing | 30 days from becoming aware of a change (422.111(m)); 30 calendar days for the API | At least 30 days, with removal of a departed provider within 5 business days |
| Verification cycle | None fixed in the sections opened; attestation at least annually | Every 90 days; every 12 months for three facility types |
What it costs
The cost has three parts. Authority fees: the proposed rule sets no fee for the program in the text we opened. Consulting: IHS scopes each engagement after a free introductory call; this page carries no IHS figure. Scope moves with the number of plans, provider records and data vendors, and how much of a verification procedure already exists. Internal staff time: network, compliance and data staff will spend time on outreach, the correction log and sampling, in proportion to the directory's size.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not a final rule. CMS's rule is proposed and the final text may differ.
- It does not promise a score. Your plan, not IHS, reports to CMS.
Frequently asked questions
What would the proposed Medicare Advantage provider directory rule require?
It would require MA organizations offering a specified MA plan to verify each listed provider at least every 90 days (hospitals and some facilities every 12 months), flag entries they cannot verify, remove departed providers within 5 business days, and report an annual accuracy score. It would apply from contract year 2028 and is not final: CMS-4214-P, October 20, 2026.
How often must a provider directory be verified under the proposal?
At least once every 90 days for each listed provider, and at least once every 12 months for hospitals and other facilities listed at 422.116(b)(2)(i), (iv) and (v): acute inpatient hospitals, critical care services and surgical services.
What if a plan cannot verify a provider's directory information?
If the plan cannot verify a provider during the applicable cycle, the proposed text requires a clear indication in the directory that the provider's information may not be up to date. CMS says the indicator must be removed or revised if the plan later verifies or updates the information.
How fast must a departed provider be removed from the directory?
No later than 5 business days after the date the plan determines the provider is no longer participating in the network of the specified MA plan. CMS says this covers the online directory and the printable electronic copy, not a new mailed directory.
When would the directory accuracy requirements start?
CMS proposes contract year 2028, which begins January 1, 2028. The first accuracy report would be due by the first Monday in April of the year after the contract year measured.
Is the provider directory accuracy rule final?
No. It is a proposed rule published October 20, 2026; comments must be received by 5 p.m. Eastern Standard Time on December 15, 2026 to be assured consideration. A final rule may change the text, so IHS marks every provision as proposed.
What does a provider group need to do about the proposed rule?
The proposal places its duties on MA organizations. Plans would have to add provider contract terms requiring accurate directory information and the earliest appointment date, so a group should expect new language and more verification requests.
What does IHS draft for a provider directory accuracy program?
IHS drafts the verification procedure, outreach schedule, correction log, sampling and scoring workbook, provider contract language and vendor oversight plan.