Compliance Guide

CMS Provider Directory Requirements 2026

Inaccurate directories expose health plans to massive financial penalties and erode member trust when it matters most.
Inaccurate directories expose health plans to massive financial penalties and erode member trust when it matters most.
Schedule a ConsultationDownload Compliance Action Plan
Self-Assessment

Are You Compliant with the July 1, 2025 CMS Requirements?

Take this 60-second assessment. Check each box that applies.

2 Business Day Updates: Can your directory be updated within 2 business days of any provider change?
90-Day Verification: Do you verify ALL provider information every 90 days?
ADA Accommodations: Are wheelchair accessibility and physical accommodations searchable by members?
Cultural Competencies: Can members search by languages spoken and cultural specializations?
Specialized Training: Do you display board certifications, fellowships, and specialized treatment approaches?
CHIP Locations: Are CHIP-accepting locations marked at the location level (not just provider level)?
Telehealth Services: Is telehealth availability and service types displayed for applicable providers?
Audit Documentation: Do you have automated audit trails documenting every directory change?
Your Score
0/8 — Critical Gaps
Regulatory Landscape

Three Federal Regulations Govern Provider Directories

JANUARY 1, 2022
No Surprises Act
Update directories within 2 business days of receiving verified provider changes
Verify all provider information every 90 days
Respond to member directory inquiries within 1 business day
Maintain documented verification processes
PENALTY
Up to $100/day per individual affected by inaccuracy
If a member relies on your inaccurate directory, you must process their claim as in-network even if the provider is out-of-network.
JULY 1, 2025
CAA Section 5123
Make directories searchable by ADA accommodations, cultural competencies, specialized training, and CHIP locations
Publish machine-readable provider directory data via public-facing FHIR API
Update JSON file format to use "sex" field instead of "gender"
Apply to Medicaid FFS, Medicaid MCOs, CHIP programs
States can receive 90/10 enhanced FFP for directory system development and operations.
ONGOING
MA Star Ratings
Annual CMS secret shopper testing
Member satisfaction surveys
Complaint volume analysis
JANUARY 1, 2022
Up to $100/day per individual affected by inaccuracy
July 1, 2025 — Now in Effect

New Searchable Fields Required

Members must be able to search and filter by these categories in your publicly accessible directory.
ADA Accommodations
Wheelchair-accessible entrances, parking, exam rooms
Accessible medical equipment
Sign language, TTY/TDD, Braille materials
Cultural Competencies & Languages
Specific languages spoken (provider and staff)
On-site interpreter services
Cultural specializations
Specialized Training
Board certifications and subspecialties
Fellowship training
Evidence-based therapy modalities (CBT, DBT, EMDR)
CHIP Locations
Location-specific CHIP acceptance (not provider-level)
Telehealth Details
Types offered (video, phone, secure messaging)
Service-specific availability (initial vs. follow-ups)
Ongoing Update & Verification Requirements
Requirement
Timeline
Applies To
Directory updates
2 business days
Every provider change
Provider verification
Every 90 days
Every provider in network
Member inquiry response
1 business day
All directory questions
Machine-readable API
Published & accessible
Medicaid/CHIP plans
By Plan Type

Plan-Specific Requirements at a Glance

Requirement
Medicaid
CHIP
Medicare Advantage
ACA Marketplace
Update frequency
Monthly min
2 business days
2 business days
2 business days
Verification
90 days
90 days
90 days (monthly Q4)
90 days
Complaint response
2-3 days*
2-3 days
24-72 hours
2-3 days
Paper directory
Yes, 5 days
Yes, 5 days
Yes, 3 days
On request
Star Ratings impact
No
No
Yes - Major
No
Public FHIR API
Required
Required
Encouraged
No (JSON only)
Secret shopper testing
State-level
Limited
Yes, annual
Limited
Requirement
Update frequency
Medicaid
Monthly min
CHIP
2 business days
Medicare Advantage
2 business days
Medicaid
2 business days
Requirement
Verification
Medicaid
90 days
CHIP
90 days
Medicare Advantage
90 days (monthly Q4)
Medicaid
90 days
Requirement
Complaint response
Medicaid
2-3 days*
CHIP
2-3 days
Medicare Advantage
24-72 hours
Medicaid
2-3 days
Requirement
Paper directory
Medicaid
Yes, 5 days
CHIP
Yes, 5 days
Medicare Advantage
Yes, 3 days
Medicaid
On request
Requirement
Star Ratings impact
Medicaid
No
CHIP
No
Medicare Advantage
Yes - Major
Medicaid
No
Requirement
Public FHIR API
Medicaid
Required
CHIP
Required
Medicare Advantage
Encouraged
Medicaid
No (JSON only)
Requirement
Secret shopper testing
Medicaid
State-level
CHIP
Limited
Medicare Advantage
Yes, annual
Medicaid
Limited
*Varies by state
State Variations: Some States Require Stricter Timelines
New York

15-day updates (general), real-time for behavioral health

California

Monthly updates minimum

Texas

3 business days for behavioral health

Financial Risk

Penalties & Financial Risk

Violation Type
Penalty Amount
Applies To
No Surprises Act
$100/day per individual
All group/individual plans
Medicare Advantage
Up to $25,000 per determination
MA plans
ACA Marketplace
$100/day per beneficiary
Marketplace plans
Provider non-compliance
$10,000 per violation
Providers
Claims Reprocessing

Must treat out-of-network as in-network when directory was wrong. Refund members plus interest.

Star Ratings Impact

0.5 star drop = $10M–$25M annual revenue loss for a 50K-member plan.

Operational Burden

Streamlining directory maintenance could reduce administrative burden by 40%.

CMS Audit Triggers
High member complaint volume
Poor Star Ratings (MA plans)
Previous uncorrected findings
Significant network changes
Random selection
Audit timeline: 30 days to submit documentation of verification processes, accuracy rates, and corrective actions.
THE PROBLEM

Why Manual Processes Can't Keep Up

The Math Doesn't Work
For a 5,000-provider network:
90-day verification = 55+ verifications daily
15–20 minutes per verification = 14–18 staff hours daily
Requires 2–3 full-time staff just for verification
Result: 15–25% error rate despite the effort
Annual Cost of Manual Processes

$800K – $1.08M

Staff (10–13 FTE × $60K)
$600K–$780K
Legacy systems
$50K–$100K
Management overhead
$150K–$200K
CMS violations
Member complaints
Star Rating impacts
Penalty exposure
THE solution

How Leap Orbit Solves This

Mix, match, and stack our AI-powered roster processing, provider data deduplication, enrichment, and standardization, or provider directory solutions.

95%+

Accuracy

Zero

Violations

100%

Audit Trails
Automated Compliance
2 business day updates with real-time data feeds
90-day verification via provider portals
1 business day member inquiry tracking
Complete timestamp documentation
July 2025 Requirement Coverage
Searchable ADA accommodations
Cultural competencies and languages
Specialized training and certifications
CHIP location-level tracking
HL7 FHIR API publishing
Audit Readiness
Real-time accuracy dashboards
Automated compliance scorecards
Secret shopper testing
CMS audit documentation at fingertips
Member Experience Excellence
Advanced search with filters
Mobile-responsive design
ADA Section 508 compliant
Multiple language support
"Leap Orbit's expertise in healthcare operations, innovative solutions, and dedicated support have driven measurable improvements. Integrating Convergent has drastically reduced the resources spent on managing fragmented provider data."
— Erin Liberti, VP of Provider Relations, CenterLight Healthcare PACE
Schedule a Demo
faq

Frequently Asked Questions

Do we need a public-facing FHIR API?
Yes, if you're a Medicaid FFS program, Medicaid MCO, or CHIP plan. The API must be publicly accessible without authentication, using HL7 FHIR Release 4.0.1 standard.
How much can CMS fine us for directory inaccuracies?
No Surprises Act: $100/day per individual. Medicare Advantage: up to $25,000/day per beneficiary. State fines vary ($250K-$35OK in California cases).
Can we do this manually or do we need automation?
Manual processes require 2-3 FTE just for verification, cost $800K-$1M annually, and still achieve only 75-85% accuracy. Automation costs $200K-$35OK, requires minimal staff, and achieves 95%+ accuracy.
How does directory accuracy impact MA Star Ratings?
Measure C3.03 evaluates directory accuracy through secret shopper testing and complaints. Lower accuracy = lower Star Ratings = reduced Quality Bonus Payments ($1OM-$25M potential loss for medium plans).
How long does it take to become compliant?
Full implementation typically takes 4-6 months: collecting new data elements, updating database schemas, making fields searchable, and establishing automated workflows.
Which data elements must be searchable as of July 2025?
ADA accommodations, cultural competencies/languages, specialized training/certifications, and CHIP location-level acceptance. Members must be able to filter by these fields on your publicly accessible directory.
What happens if we miss the 2 business day deadline?
You're non-compliant. If a member is affected, you face penalties and must process their claim as in- network even if the provider is out-of-network.
What's the difference between the 2 business day update rule and 90-day verification?
The 2 business day rule (No Surprises Act) requires updates within 2 business days of receiving verified provider changes. The 90-day verification requires proactive contact with every provider every 90 days to confirm accuracy, even if nothing has changed.
Resources

Free Compliance Tools

2025 Compliance Roadmap
Monthly implementation timeline
Readiness Checklist
50+ point gap assessment
ROI Calculator
Manual vs. automated cost comparison
State Requirements Matrix
Medicaid requirements by state

Ready to Achieve Full Compliance?

Talk to our experts about automating your provider directory compliance before the next audit.
Schedule a Call