Center for Federal Accountability

Medicare Advantage provider directories: CMS proposes plan-graded accuracy scores, a 10-year directory archive and billing protections

CMS proposes to make Medicare Advantage plans check every directory listing at least every 90 days, grade their own directories A through F from a random sample, and keep a daily directory archive for 10 years so that enrollees who relied on a wrong listing pay only in-network cost sharing. CMS's own reviews from 2022 to 2024 found at least one error in 44.29 percent of listings checked, but the proposal leaves the sample size, the sampling date and any independent check of the grades undecided. Comments close December 15, 2026.

2026-10-21 · Centers for Medicare & Medicaid Services, Health and Human Services Department · Information · Docket CMS-4214-P

On October 20, 2026, the Centers for Medicare & Medicaid Services (CMS) proposed rules to carry out three sections of the Consolidated Appropriations Act, 2026, Public Law 119-75, enacted February 3, 2026 (91 FR 66408). This article covers section 6220, the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, which sets accuracy rules for the provider directories Medicare Advantage plans publish. The proposal carries file code CMS-4214-P and RIN 0938-AV88. Comments are due by 5 p.m. Eastern Standard Time on December 15, 2026. None had been posted as of CFA's October 20 refresh; the Federal Register record showed two on October 21.

## What would change

Starting in contract year 2028, every Medicare Advantage plan with a provider network would have to verify each directory listing at least once every 90 days. Acute inpatient hospitals, intensive care units and surgical facilities would be checked at least once every 12 months. Plans could verify by phone, email, provider attestation, their own records, claims data or CMS data sources. A listing that cannot be verified would carry a notice that it "may not be up to date," and a provider who leaves the network would have to be removed within 5 business days (91 FR 66413-66415).

Directories would also have to flag providers under common ownership or control with the plan or its parent company, an element CMS added to the statute's list by reading its "such as" as open-ended (91 FR 66411-66412).

Each year, each plan would estimate its own directory accuracy from a random sample of listings: 65 percent drawn from all providers and 35 percent from mental health and substance use disorder specialties, the only specialty type CMS proposes to treat as having high inaccuracy rates. Elements are scored accurate or not and weighted (network participation 40 percent, contact information 20, address 20, specialty 10, and the rest 10 together), and the result becomes a letter grade from A (90 to 100) through E (50 to 59) to F (91 FR 66420-66425; proposed 42 CFR 422.123(d), 91 FR 66477-66478). Plans would report their grades by the first Monday in April. Beginning in 2029, CMS would post them in a machine-readable file, and the statute requires plans to show the grade prominently in their directories (91 FR 66427).

Enrollees get a billing protection. If a provider was listed as in-network on the date the appointment was made but turns out to be out of network, the plan must limit cost sharing to the in-network amount and refund any excess. To decide those claims, plans would keep a daily archive of their online directories for at least 10 years and hand it to CMS within 5 business days on request. If the plan cannot find the appointment date or its archive within the decision deadline, the protection applies in the enrollee's favor (91 FR 66428-66429).

## The record behind it

CMS reviewed 142 Medicare Advantage organizations' online directories in three rounds between June 2022 and June 2024, calling provider offices to check listings. Of 18,852 locations for 11,360 providers, 44.29 percent had at least one inaccuracy. CMS did not publish a report on these reviews (91 FR 66418). CMS's last published review report, from 2018, found inaccuracies at 48.74 percent of locations, with plan-level rates from 4.63 percent to 93.02 percent; its two earlier rounds found 45.10 and 55.07 percent.

The HHS Office of Inspector General reported in October 2025 that, on average, 55 percent of behavioral health providers listed in the networks of the Medicare Advantage plans it studied provided no services to those plans' enrollees in 2023, and that 72 percent of the inactive providers it surveyed should not have been listed. The study covered plans in 10 counties.

The proposal builds on a September 19, 2025, rule (90 FR 45140) that already requires plans to send directory data to CMS for Medicare Plan Finder, update it within 30 days and attest to its accuracy each year. That collection is approved under OMB control number 0938-1491. CMS estimates the new requirements will cost 708 plan contracts $6,025,071 in 2028 and $1,608,453 a year after that (91 FR 66471). CFA recomputed it from the line items: $4,416,618 in one-time costs, mostly a $4,032,768 archive build, plus the annual total. It adds up. Archive upkeep, $1,008,192, is 63 percent of the annual cost.

## CFA's observations

These are CFA's observations from the published text, not findings about how plans keep their directories.

The grades would be estimated by the plans themselves. The proposal does not yet set the sample size, a minimum or maximum, the date samples are drawn, how non-responding providers are handled or a minimum response rate; CMS asks for comment on each (91 FR 66420-66422). An independent certification of the grades is only under consideration (91 FR 66427). CMS itself notes that differences in sample size "may affect the comparability of the resulting accuracy scores" and that letting plans pick their sampling date would "increase the risk of gaming." CMS's own error rates came from reviews in which its staff called the offices.

The cost estimate does not total the 90-day checks. CMS puts each verification contact at about 15 minutes, up to an hour a year per provider, but gives no aggregate; it says it "cannot estimate the total burden" of 5-day removals and lacks the provider counts needed to total appointment-date requests (91 FR 66464, 66468). The 1,062 hours it assigns to enrollee claims equal 1.5 hours for each of 708 contracts, one claim per contract per year; the refund estimate likewise assumes one refund per contract. CMS calls the volume "highly uncertain."

The proposal does not mention the Privacy Act or any system of records notice for the directory data CMS collects for Medicare Plan Finder or for the National Provider Directory it is building. Most of that data describes clinicians in their professional capacity, and a Federal Register search by CFA on October 21 found no privacy notice that mentions the National Provider Directory. Whether an existing notice covers CMS's copy is a question the record does not answer.

Two details matter for commenters. The rule's address for electronic comments points to regulations.gov docket CMS-2026-2533; regulations.gov returned no docket under that number when CFA checked on October 21. The Federal Register record links the rule to docket CMS-2026-3533, document CMS-2026-3533-0002. That docket also holds a separate document, CMS-2026-3533-0001, titled "Contract Year 2028 Policy and Technical Changes to the Medicare Advantage Program," posted October 16. And the information collection section gives OMB control number "0938-10981 (CMS-TBD)" while saying no number has yet been assigned (91 FR 66463).

## The rest of the rule

Section 6219 would end the generic drug copayment, from 2028, for about 6 million people with full Medicare and Medicaid benefits and incomes at or below the poverty level, at a net federal cost of about $1.337 billion over ten years (91 FR 66410, 66471). Section 6224 would limit pharmacy benefit managers' Part D pay to bona fide service fees at fair market value and require annual reports to plans and CMS; the statute exempts those reports from the Paperwork Reduction Act and keeps them confidential (91 FR 66457, 66461-66462). The directory grades would be public; those reports would not.

## CFA's records on HHS

The Department of Health and Human Services holds a "Minor" grade on CFA's agency scoreboard, with a composite score of 81.36 based on 4 areas, the fourth lowest of the ten agencies CFA grades. The government-wide composite is 83.38 across 8 areas. The grade does not measure Medicare Advantage directories. CFA's index counts 1,186 HHS privacy notices as of the October 20, 2026 refresh, sixth among agencies. CFA's crawl has collected no CMS privacy impact assessment pages, so its data cannot show whether one covers Medicare Plan Finder directory data.

## What to watch

Whether the final rule fixes a sample size, a common or randomly assigned sampling date and a minimum response rate, and whether it requires independent certification of the grades.

Whether CMS adds primary care, cardiology and oncology to the high-inaccuracy specialties it is still considering, and whether it publishes plan-level results of its 2022 to 2024 reviews.

Whether the final burden estimate totals the cost of 90-day verification for plans and providers, and which OMB control number the collection receives.

What the first machine-readable file in 2029 contains beyond letter grades, such as sample sizes or response rates. The Government Accountability Office must report on score trends and provider response rates by January 15, 2033.

## How to comment

Comments can be filed on regulations.gov under docket CMS-2026-3533, document CMS-2026-3533-0002, or mailed to the address in the notice, citing file code CMS-4214-P. CMS does not accept faxes. Comments on the information collection should name the rule, the section of the Code of Federal Regulations and the OMB control number.

Authorities