CMS Provider Directory Requirements: A Complete Compliance Guide for 2026-2027
Published on February 27, 2026
By: Ideon
CMS provider directory requirements now mandate 85% accuracy, 30-day updates, and annual attestation for Medicare Advantage, Medicaid, and ACA marketplace plans. Beginning plan year 2027, provider directory data will appear publicly on Medicare Plan Finder, transforming accuracy from an internal compliance function into a competitive differentiator. Organizations that treat directory infrastructure as strategic investment gain compounding advantages over those relying on manual verification.
Provider directory accuracy faces federal scrutiny at an unprecedented level. CMS’s national review found that 48.74% of provider locations in Medicare Advantage online directories contained at least one inaccuracy—wrong phone numbers, incorrect addresses, or outdated patient acceptance status.
That failure rate persists despite the healthcare industry spending more than $2 billion annually to maintain provider data. Manual verification processes cannot keep pace with the velocity of provider information changes or the escalating demands of federal regulators.
The regulatory landscape has intensified dramatically. The No Surprises Act requires 90-day verification cycles and 2-business-day directory updates. The Consolidated Appropriations Act 2023 established baseline Medicaid directory standards. And the CMS Final Rule CMS-4208-F2, finalized September 2025, mandates that Medicare Advantage organizations submit provider directory data directly to CMS for publication on Medicare Plan Finder by 2027.
For health plans, benefits technology platforms, and ICHRA administrators, this convergence of requirements creates a clear decision point: build verification infrastructure internally—a 12-18 month undertaking requiring specialized HL7 expertise—or integrate API-driven compliance solutions that deliver accuracy, scalability, and automatic regulatory updates in weeks.
This guide breaks down every requirement organizations must meet across Medicare Advantage, Medicaid, and ACA marketplace programs, and examines how modern infrastructure transforms compliance from an operational burden into strategic advantage.
What are CMS provider directory requirements?
CMS provider directory requirements: Federal regulations mandating that Medicare Advantage plans, Medicaid programs, and ACA marketplace plans maintain accurate, publicly accessible provider directories. These requirements specify what information organizations must include, how frequently they must verify it, and the consequences of non-compliance.
What directories must include. Provider identification details—name, National Provider Identifier (NPI), specialty, and board certifications—form the foundation. Practice location data encompasses physical addresses, phone numbers, and fax numbers. Accessibility information covers facility accommodations for individuals with physical disabilities. Service delivery details specify telehealth availability. Patient acceptance status indicates whether a provider accepts new patients. Cultural and linguistic capabilities include languages spoken, American Sign Language availability, and interpreter services. Network participation data encompasses network status, plan affiliations, and tier designations.
Who must comply. Medicare Advantage organizations offering coverage to Medicare beneficiaries face the most stringent standards. Medicaid managed care programs—including state Medicaid and CHIP agencies—must meet CAA 2023 requirements. ACA marketplace plans offering qualified health plans on federal and state exchanges face parallel accuracy obligations. Benefits technology platforms—ICHRA administrators, broker platforms, and HR tech vendors distributing these plan types—inherit compliance exposure through their carrier relationships.
The regulatory evolution. Three milestones define the current landscape. The Consolidated Appropriations Act 2023 established baseline provider directory standards for Medicaid and CHIP programs. CMS Final Rule CMS-4208-F2, finalized September 19, 2025, mandated Medicare Plan Finder integration for plan year 2027. The November 2025 CMS Technical Implementation Guide specified data formats, submission protocols, and implementation timelines.
CMS provider directory accuracy standards
The 85% accuracy threshold. CMS requires a minimum 85% directory accuracy rate for Medicare Advantage and ACA marketplace plans. Accuracy measurements span practice locations, phone numbers, specialty designations, and network participation status. Failing to meet the 85% threshold triggers regulatory action, corrective measures, and potential enrollment freezes.
National accuracy challenges. The gap between the 85% requirement and current performance remains significant. CMS’s national review found that 48.74% of provider locations in MA online directories had at least one inaccuracy. The most common errors include wrong phone numbers, incorrect addresses, and outdated acceptance status. Industry data indicates that only one in five health plans has achieved significant accuracy improvements despite dedicated verification efforts.
Location accuracy as critical challenge. CMS data shows that at least 45% of locations reported in directories are incorrect, with the most common issue being providers not actually practicing at published locations. Location-specific verification requires providers to accept or reject location information and provide reasons for rejections—a process that manual outreach cannot execute efficiently at scale.
CMS testing and monitoring. CMS conducts quarterly secret shopper surveys without advance warning to health plans. Random provider sampling across entire networks tests for discrepancies in contact information, location accuracy, and patient acceptance status. Monthly directory updates represent the minimum compliance obligation.
What CMS considers “accurate.” Five criteria define an accurate directory entry: the provider actively practices at the listed location; contact information (phone, fax, email) functions and remains current; specialty and credential information reflects verification against primary sources; network participation status reflects current contracts; and patient acceptance status meets required update timeframes.
Medicare Plan Finder integration for 2027
The 2027 mandate. Beginning plan year 2027, all Medicare Advantage organizations must submit provider directory data directly to CMS for publication on Medicare Plan Finder (MPF). This rule, finalized September 19, 2025 under CMS-4208-F2 and codified at 42 C.F.R. § 422.111, establishes four core obligations: make provider directory information available to CMS for publication online; submit data in a format, manner, and at times determined by CMS; update provider directory information within 30 days of becoming aware of any change; and attest at least annually that all submitted information is accurate and complete.
Implementation timeline. As of January 1, 2026, MA organizations must make directory data available to CMS. During 2026, CMS conducts validation testing to ensure directory data accurately reflects MA organization submissions. For the 2026 Plan Finder update, CMS partnered with SunFire Matrix, Inc. to populate provider details using third-party data sources, establishing a benchmark for data completeness and reliability. By the 2027 open enrollment period, provider directories sourced directly from MA organizations appear publicly on Medicare Plan Finder.
CMS issued the provider directory requirement through a separate final rule to provide MA plans “maximum lead time” for preparation. That lead time narrows with each passing quarter.
Why this integration matters. This mandate transforms provider directory accuracy from an internal audit metric into a public-facing quality indicator. Beneficiaries compare provider networks across all MA plans on a single platform for the first time. Directory quality directly affects plan selection, member trust, and competitive positioning. Plans with incomplete or inaccurate data visible on Medicare Plan Finder face reputational consequences that compound through lower enrollment.
Data format and technical submission requirements
FHIR-based API standard. CMS requires the Health Level Seven International (HL7) FHIR standard for provider directory APIs. MA organizations have maintained provider directory APIs since July 1, 2021, under the Interoperability and Patient Access Final Rule. For Medicare Plan Finder integration, CMS accepts data via MA plans’ existing FHIR-based JSON APIs—aligning the submission standard with infrastructure that compliant organizations already operate.
National provider directory vision. CMS intends for the National Provider Directory, once fully implemented, to consume MA plan FHIR-based APIs directly. Data feeds to Medicare Plan Finder enable real-time provider information updates across all plans. The November 2025 CMS Technical Implementation Guide provides specifications for data formats, submission protocols, and timing milestones.
Required data elements. CMS requires all information described in § 422.111(b)(3)(i): provider identification and credentials, all practice locations with contact information, network participation and tier status, accessibility and telehealth capabilities, patient acceptance status, and cultural and linguistic accommodations. Each data element must meet the format specifications outlined in the November 2025 CMS Technical Implementation Guide, which organizations must follow when making provider information available.
Consistency between submissions. CMS did not finalize the proposal requiring direct attestation that directory data matches network adequacy submissions. However, plans must maintain consistency between the two. Discrepancies between provider directory submissions and Health Service Delivery (HSD) network filings trigger compliance review and audit exposure.
Medicaid and ACA marketplace directory requirements
CAA 2023 requirements. The Consolidated Appropriations Act 2023 requires both fee-for-service (FFS) and managed care Medicaid programs to update network provider directories quarterly. Directories must include each provider’s name, address, phone number, and specialty. Medicaid directories carry additional data requirements: facility accommodations for individuals with physical disabilities, provider website URLs, telehealth availability, whether providers accept new Medicaid or CHIP patients, and American Sign Language availability along with other cultural and linguistic capabilities.
State agency obligations. State Medicaid and CHIP agencies providing FFS services must incorporate required information into provider directories. Enhanced federal financial participation supports the design, development, implementation, and maintenance of state Medicaid IT systems for FFS provider directories.
30-day update requirement. Medicaid managed care programs must update directories within 30 days of becoming aware of changes. This requirement took effect July 1, 2025, for Medicaid CAA compliance.
ACA marketplace standards. ACA marketplace plans face the same 85% accuracy threshold as Medicare Advantage plans. Monthly update cycles represent the minimum obligation. CMS conducts secret shopper testing without advance notice across marketplace plans, applying the same verification methodology used for MA directory reviews.
Corrective action plans. CMS July 2024 guidance established corrective action plan requirements for organizations failing to meet directory accuracy standards. These procedures outline the steps for returning to compliance after directory accuracy failures, including documentation requirements and remediation timelines.
Enforcement mechanisms and penalties
Escalating penalty structure. CMS enforces directory accuracy through a progressive framework. Warning letters represent the initial enforcement action. Corrective action plans follow for organizations failing the 85% threshold. Repeated failures trigger enrollment freezes—stopping new member acquisition during critical growth periods. Plan termination remains a possibility for organizations demonstrating persistent non-compliance.
Audit landscape. At least half of surveyed health plans reported audits since January 2016, when CMS directory regulations took effect. Among those audited, nearly 70% measure directory accuracy quarterly or monthly. The audit landscape intensifies with Medicare Plan Finder integration: beginning 2027, directory accuracy becomes publicly visible, enabling beneficiaries to directly assess provider network quality when comparing plans.
Financial impact. Non-compliance creates cascading costs: regulatory penalties and fines, accelerated member disenrollment, reputational damage in competitive markets, and increased call center volume addressing member complaints from directory errors. For organizations operating in multiple states, the compounding effect of multi-jurisdictional non-compliance accelerates these costs further.
Public accountability through Medicare Plan Finder. Beginning 2027, directory accuracy becomes publicly visible on Medicare Plan Finder. Beneficiaries directly assess provider network quality when comparing plans, making poor directory accuracy a measurable competitive disadvantage in a transparent marketplace.
Documentation obligations. MA organizations must attest annually to directory accuracy, maintain audit trails demonstrating continuous monitoring, and document all verification processes and update procedures.
Compliance challenges and operational burden
Resource-intensive manual verification. Provider practices field outreach from multiple health plans, all seeking the same information through different channels and timelines. Health plans allocate significant resources to phone, mail, and fax outreach—efforts that collectively account for a portion of the $2 billion the commercial healthcare industry spends annually maintaining provider data. Only one out of five health plans has achieved significant improvements from these verification efforts.
Data fragmentation. Provider information scatters across credentialing, enrollment, claims, and directory systems with no single source of truth. Inconsistencies compound as data ages. Batch processing creates delays between provider changes and directory updates—delays that regularly exceed regulatory timelines.
Provider engagement difficulties. Low response rates to verification outreach persist across the industry. Providers lack direct incentive to prioritize directory update requests among competing administrative demands. Multi-plan coordination—where providers must respond to verification requests from every health plan in their network—creates confusion and incomplete responses. Without a standardized process, information updates submitted to one plan do not automatically propagate to all relevant plans.
Technical barriers. FHIR API implementation requires specialized HL7 expertise that many organizations lack internally. Legacy systems may not support real-time data exchange. The 2027 Medicare Plan Finder deadline compresses implementation timelines for organizations that have not yet built compliant infrastructure. Testing and validation periods add further complexity to an already constrained compliance timeline.
Regulatory timeline pressures. The 30-day update requirement proves difficult to achieve with manual processes. Annual attestation obligations demand continuous accuracy monitoring rather than point-in-time corrections. The convergence of the 2027 Medicare Plan Finder deadline with existing No Surprises Act requirements creates overlapping compliance obligations that strain operational capacity.
Modern compliance solutions and best practices
Centralized provider data platforms. A single source of truth eliminates the inconsistencies that plague distributed systems. Providers update information once, and changes propagate to all participating health plans automatically. CAQH DirectAssure demonstrates this model: leveraging data from CAQH ProView, conducting provider outreach aligned with regulatory reporting requirements, and enabling providers to review, update, and attest to practice information shared with all participating plans.
The results from centralized approaches are measurable. One health plan achieved 84% directory accuracy for Medicare Advantage plans using the CAQH solution—far exceeding the national average of 50% or lower. Nearly 40,000 providers completed profiles and attested to accuracy within three months, with a Net Promoter Score of 70 indicating strong provider preference for automated workflows over manual outreach.
API-driven compliance infrastructure. Real-time data exchange replaces batch processing and manual outreach. FHIR-based APIs meet CMS technical requirements for the National Provider Directory and Medicare Plan Finder integration. Automated verification against primary sources—NPPES, medical boards, DEA registries—replaces phone calls and fax surveys. Continuous monitoring identifies changes and triggers update workflows within regulatory timeframes.
Implementation considerations. Organizations face a clear build-versus-integrate decision. Building FHIR API infrastructure internally requires specialized HL7 expertise, 12-18 months of development, and ongoing maintenance as CMS requirements evolve. Integrating third-party compliance platforms accelerates time-to-compliance through subscription models that include automatic regulatory updates. For organizations approaching the 2027 Medicare Plan Finder deadline, timeline alone often determines the path.
Location-specific validation. Enhanced verification functionality addresses CMS’s identified location accuracy challenge. Location-specific questions require providers to accept or reject location information and provide reasons for rejections. This approach enables health plans to reconcile discrepancies systematically—addressing the most persistent compliance failure point in CMS audit findings.
How Ideon addresses CMS directory compliance
IdeonSelect delivers normalized provider directory data through a unified API, providing the infrastructure layer that health plans, ICHRA administrators, and benefits technology platforms need to meet CMS directory requirements without building verification systems from scratch.
- Unified provider data access: Single API integration provides access to provider networks across 300+ carriers, eliminating the need to build and maintain individual carrier connections for directory data
- Real-time provider search: Normalized provider data—specialties, locations, credentials, network status—meets CMS accuracy and timeliness requirements through continuous data updates
- Compliance-aligned update cycles: Automated verification workflows align with CMS 30-day, quarterly, and annual requirements, ensuring directory accuracy meets the 85% threshold
- FHIR-compatible architecture: Infrastructure designed for interoperability supports Medicare Plan Finder integration timelines and CMS technical submission requirements
- Enterprise-grade security: SOC 2 Type II certified and HIPAA compliant infrastructure removes months of compliance certification work
For benefits technology platforms distributing Medicare Advantage, Medicaid, or ACA marketplace plans, IdeonSelect enables compliant provider search without building verification infrastructure internally. The 4-8 week implementation timeline supports organizations preparing for the 2027 Medicare Plan Finder deadline—while competitors spend 12-18 months building the same capabilities from scratch. Automated compliance monitoring and multi-carrier integration through a single API reduce the operational burden that manual verification processes impose on health plan and provider staff alike.
Final words
CMS provider directory requirements have evolved from periodic audit exercises into continuous compliance obligations with public accountability. The 2027 Medicare Plan Finder mandate transforms directory accuracy from an internal metric into a competitive differentiator visible to every Medicare beneficiary comparing plans.
Manual verification cannot achieve the accuracy, timeliness, or scale these requirements demand. Organizations using centralized API platforms achieve 84% directory accuracy versus the 50% national average, while reducing operational burden and compliance risk.
The decision is straightforward: build specialized FHIR infrastructure internally over 12-18 months, or integrate proven API solutions that deliver compliant provider data in weeks. Organizations that act now position themselves to meet 2027 deadlines and convert directory accuracy into a member trust advantage.
Explore Ideon's IdeonSelect for health plans and benefits platforms
Ready to take the next step? See how Ideon works.