Directories on the Hook: CMS Proposes New Medicare Advantage Directory Rules

On October 20, 2026, the Centers for Medicare & Medicaid Services (CMS) published in the Federal Register a proposed rule (CMS-4214-P) implementing three provisions of the Consolidated Appropriations Act, 2026, which was signed into law on February 3, 2026:

1. lower generic copayments for certain low-income Part D enrollees;
2. new obligations for pharmacy benefit managers (PBMs); and
3. requirements imposed on Medicare Advantage plans (MA or Part C) as part of the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act (“REAL Act”).

This Insight focuses on the REAL Act and its new verification, reporting, disclosure, and liability requirements imposed on MA plans, beginning in contract year 2028.  

CMS is accepting comments on more than a dozen specific alternative approaches to implementing the REAL Act’s requirements until December 15, 2026. As we explain in this Insight, there are at least four issues that interested parties should consider submitting comments on: cost-sharing mechanics, non-responding provider-originated data, scoring parameters, and timing.

Background on the REAL Act

The REAL Act stems, at least in part, from congressional concerns regarding ghost networks in MA and surprise out-of-network costs, and from an effort to impose parallel verification and consumer protection requirements in MA as had been imposed on private plans under the No Surprises Act. Also spurring action were the poor results from CMS’s review of the online directories of 142 MA organizations, from June 2022 through June 2024. Of the 18,852 provider locations reviewed (covering 11,360 providers), 44.29 percent had at least one inaccuracy, such as an incorrect address or telephone number, a provider who did not see patients at the listed location, or a provider who did not accept the plan. In October 2025, the U.S. Department of Health and Human Services Office of Inspector General (OIG) reported that, on average, 55 percent of the behavioral health providers listed in the plan networks it studied provided no services to enrollees in 2023, and that 72 percent of the inactive providers in its survey should not have been listed.[1]  

Historically, MA provider directory obligations have been spread across 42 C.F.R. Part 422: content requirements at § 422.111(b)(3), website and hardcopy requirements at §§ 422.2265 and 422.2267(e)(11) (including a 30-day update standard), and the provider directory application programming interface (API) at § 422.120. Beginning with contract year 2026, § 422.111(m) also requires MA organizations to submit directory information to CMS for publication on Medicare Plan Finder, update it within 30 days of learning of a change, and attest to its accuracy at least annually (finalized at 90 Fed. Reg. 45140). Under Health Plan Management System (HPMS) memoranda issued January 3, 2020, and June 29, 2022, CMS has not treated errors that match the National Plan and Provider Enumeration System (NPPES) as compliance errors if the plan contacts the provider within 30 days. CMS is also developing a National Provider Directory (NPD) to serve as the authoritative public-facing source of directory data.

Enacted in 2026, the REAL Act has a requirements phase that begins with contract year 2028. Plan directory accuracy is to be scored and publicly posted beginning in 2029.  The REAL Act requires a public stakeholder meeting (which CMS held on June 15, 2026) and directs CMS to issue directory guidance to MA organizations within 18 months of enactment and NPPES-update guidance to Part B providers within 12 months. It also calls for a Government Accountability Office report in 2033.

CMS presents the rule as building on § 422.111(m) and the NPD rather than creating a parallel regime, and as advancing the administration’s transparency agenda (Executive Orders 13877 and 14221). The statute requires CMS’s scoring methodology to account for the administrative burden on plans and providers and the relative importance of each element to enrollees’ ability to access care. Those two criteria are the lens through which CMS’s choices, and any comments on them, will most likely be judged.

Compare and Contrast Statute and Proposed Rule

The chart below compares several aspects of the statute with how the proposed rule addresses them. Bear in mind that CMS’s rule is only a proposal and may change before it is finalized.

	REAL Act – Statute	CMS Proposed Rule
Directory Accuracy Verification	Beginning in contract year 2028, MA organizations must verify each listed provider's directory information at least every 90 days (at least every 12 months for hospitals and other facilities CMS designates), flag providers they cannot verify, and remove providers that no longer participate within five business days.	Limit the 12-month cycle to acute inpatient hospitals, intensive care units, and surgical services; specify permitted verification methods; and require provider contracts to obligate providers to keep directory information current and accurate.
Public Accuracy Grade	Beginning in contract year 2028, each plan must annually analyze a random sample of its directory and report an accuracy score to CMS. Beginning in 2029, CMS must post the scores and plans must display them in their directories.	Express the score as an A-through-F letter grade, reserve 35 percent of each sample for behavioral health specialties, weight network participation at 40 percent, and require reports by the first Monday in April.
Cost-Sharing Backstop	Beginning in contract year 2028, an enrollee furnished care by a non-participating provider that was listed in the plan’s directory on the date the appointment was made pays no more than in-network cost sharing, and plans must notify enrollees of the protection.	Scope: Limit the protection to the online directory, while asking whether to extend it to the hardcopy directories plans must provide on request. Mechanics (not in the statute): Apply the protection automatically when the plan knows or reasonably should know it applies; default in the enrollee’s favor when the plan cannot document the appointment date or directory history in time; require a 10-year directory archive; and require provider contract terms, surviving termination for 10 years, to supply appointment records.

While the statute fixes the core duties, CMS’s discretion lies in how those duties are measured, proven, and enforced, and the proposal exercises that discretion in ways that will matter more to plans than the statutory text itself.

(1) The cost-sharing protection becomes a burden-of-proof regime. The statute caps cost sharing and requires notice. It does not require automatic application, an enrollee-favoring default, a 10-year directory archive, or provider contract terms that survive termination. CMS relies on its general authority under sections 1856(b)(1) and 1857(e)(1) of the Social Security Act for those additions. Together, they mean that a plan unable to document the appointment date or directory history within the decision timeframe loses by default and bears the burden of proving the protection does not apply.

• Proof depends on third parties. A provider that has left the network, or that never contracted but was listed in error, has little incentive, and in the second case no contractual duty, to produce scheduling records. The preamble’s example of what would defeat the default (“proof that the provider was never in the specified MA plan network”) also appears to conflict with the statute, which covers a provider that is “not participating” but listed.
• Existing rules point in different directions. Section 422.568(a)(2) requires payment requests to be in writing unless a plan has chosen to accept verbal requests, while proposed § 422.124(c)(1) accepts them. For payment requests, the processing clock runs through § 422.568(c) to the prompt-payment rules in § 422.520, yet the proposal refers only to “applicable standard or expedited organization determination timeframes.” The preamble speaks of “reasonable, good-faith efforts” to gather documentation, but the regulatory text contains no good-faith safe harbor.
• The exposure may be wider than proposed. The statute keys the protection to the directory “as required to be provided to an enrollee,” which is broader than the online directory CMS proposes. According to the preamble, a listing carrying the “may not be up to date” notice remains covered.

(2) The score’s design will decide what it measures. The rule text requires a random sample “as specified by CMS” and leaves sample size, sampling date, replacement and non-response rules, and mental health specialty codes to later action. The statute says “accuracy score” and a random sample “of providers.” The letter grade, the 65/35 split, and a sampling frame built on unique provider, address, and telephone records are CMS’s implementation choices. Several consequences follow:

• If a non-responding provider counts as inaccurate, the grade partly measures provider responsiveness rather than plan accuracy. CMS is considering replacement records and minimum response rates but has not yet decided.
• Half of the weight (network participation and specialty) can be verified from plan data or claims. The other half (contact information and address at 40 percent, and three smaller elements at 10 percent) depends on reaching providers.
• Reserving 35 percent of every sample for mental health and substance use disorder providers will weigh heavily on plans with thin behavioral health networks. CMS’s published review tables do not break out mental health results, and the OIG findings cite concerns with inactive providers rather than listing errors.
• Plans that share a network can receive different grades through sampling variance. CMS also proposes to count a data element as accurate only if every component is correct, so an address with three of five components right would score zero, although CMS is considering partial credit. CMS’s prior reviews excluded several plan types, so there is no baseline for them.
• Contract year 2028 is the first year measured, and the first report is not due until April 2029, but contract year 2029 directories must reach enrollees by October 15, 2028. The proposal does not say what those directories will show or whether plans must update them when scores are posted.

(3) Verification and removal rules raise practical conflicts.

• The 12-month cycle is limited to three facility types. The statute lets CMS apply the longer cycle to “any other facility determined appropriate,” but skilled nursing facilities, inpatient psychiatric facilities, outpatient behavioral health providers, and infusion, imaging, and therapy providers would remain on the 90-day cycle.
• The trigger for five-business-day removal (when the plan “determines” that a provider no longer participates) is undefined. Read as the date a provider gives notice of termination, it would require removal weeks before the termination takes effect, in tension with the advance enrollee notices required by § 422.111(e) and the 60-day without-cause notice period in § 422.202(d)(4).
• NPPES is a permitted method for the 90-day verification but not for the score, and CMS would rescind its 2020 and 2022 memoranda. A plan could comply with the verification rule using NPPES and still be graded down on the same data, with no compliance-review safe harbor.

(4) Scope questions are unresolved.

• Cost plans. The statute defines “specified plan” by cross-reference to “network-based plan” in section 1852(d)(5)(C), and CMS’s definition (through § 422.2) includes section 1876 cost plans. But the statutory duties run to “MA organizations,” and the proposal amends nothing in Part 417. Cost plan sponsors should ask whether and how these requirements reach them.
• Employer group plans. CMS’s application materials indicate that it waives the § 422.111 disclosure requirements for employer group and direct contract plans where the employer is subject to alternative disclosure requirements. The proposal does not say whether those waivers extend to the new disclosures or to §§ 422.123 and 422.124.
• Dual eligible enrollees. Section 422.111(k)(5) excuses plans from sending explanations of benefits (EOBs) to dual eligible enrollees, yet the statute requires the protection notice in the first EOB. The proposal offers no alternative notice for enrollees in dual eligible special needs plans (D-SNPs).

(5) The cost record is thin, and the gap is the strongest comment opportunity. The regulatory impact analysis estimates REAL Act costs of about $6.0 million in 2028 and $1.6 million per year thereafter across 708 MA contracts, and concludes the costs are de minimis. Those figures rest on assumptions of 13 to 30 hours per parent organization for the annual accuracy analysis, 40 hours per contract to build the daily archive (plus 10 hours per year to maintain it), and 1.5 hours per contract per year to process cost-sharing requests. CMS assumes each direct verification contact takes about 15 minutes of provider time and 15 minutes of plan time, but the totals do not appear to include the 90-day verification cycle itself. The estimate also does not quantify the cost-sharing differential or payment to non-contracted providers, which § 422.214 sets at Original Medicare amounts. Because the de minimis conclusion rests in part on the premise that plan costs are government-supported, these omissions matter more.

Market and Compliance Implications

The proposal moves cost and risk to whoever controls the data and the money, and the effects will show up in bids, provider contracts, network strategy, and the competitive use of the grade.

Pricing and operations. Contract year 2028 bids are due in June 2027, before a final rule is likely and before CMS’s statutory directory guidance (due about August 2027). Plans must price three new cost lines without final parameters: directory operations (verification, flagging, and the archive), the cost-sharing differential when a listed provider turns out not to participate (a medical cost, not an administrative one), and payment to non-contracted providers. The scale is easy to underestimate. A network of 50,000 listed providers verified quarterly implies 200,000 provider verifications per year before the choice of methods reduces direct outreach.

A public competitive signal. Beginning in contract year 2029, each plan’s grade will be posted in a machine-readable file and displayed in its directory. Brokers, counselors, advocates, and researchers will use it, and plans that share a network can receive different grades. CMS suggests directory language along the lines of “Information Accuracy: [letter grade].” Any use of a grade in marketing will be governed by § 422.2262(a)(1), which bars inaccurate or misleading statements and requires documentation for superlatives, but the proposal is silent on how plans may describe a grade.

Network strategy and contracting.

• Expect more terminations of inactive or unresponsive providers and tighter data-maintenance terms in provider contracts, constrained by § 422.202(d), enrollee notice duties, and network adequacy.
• Because the directory must list every contracted and participating provider, plans cannot improve a score by delisting providers who remain under contract.
• Fixed costs such as the archive and verification infrastructure weigh more heavily on small and special needs plan carriers.
• Holdouts and delegated entities that control their own provider data will be the hardest contract amendment cases.

Providers. The verification burden multiplies across plans. At CMS’s assumption of about 15 minutes per direct contact, a practice contracted with 15 MA organizations faces roughly 15 hours per year if every plan contacts it each quarter, before counting multiple locations. Providers will also take on new contract duties, including maintaining directory data and supplying appointment records for 10 years after termination, and the “may not be up to date” notice will be visible to enrollees. Expect requests for standardized portals, fee relief, and limits on recoupment. Behavioral health providers will face the most scrutiny.

Vendors and data infrastructure. Demand will grow for verification, outreach, and archiving services. Until CMS issues guidance on the line between plan-originated and NPD-enriched data, accountability stays with the plan for the data it submits, verifies, and attests to.

Compliance program implications.

• Enforcement: Section 422.504(a)(22) would make the accuracy analysis a contract term, and § 422.752(a)(5) (misrepresenting information furnished to CMS or enrollees) is an existing sanction basis. The proposal does not say what consequence a low grade carries beyond publication.
• Data consistency: The directory, network adequacy tables, the § 422.111(m) submission, and the § 422.120 API must describe the same providers, and the annual attestation will sit beside a public grade. CMS’s network adequacy guidance expects plans to notify CMS when they discover a network gap, so directory remediation can surface adequacy issues.

Options and Strategy for Submitting Public Comments

Comments are due by 5:00 p.m. Eastern on December 15, 2026, through regulations.gov (docket CMS-2026-2533). As stated above, CMS has asked for comment on more than a dozen specific alternatives, and a final rule can adopt those alternatives without a further proposal.

The most effective comments support the statute’s objective, accept responsibility for what plans control, and argue from the criteria CMS itself has adopted: administrative burden, relative importance of each element to enrollee access, comparability across plans, harmonization with § 422.111(m) and the NPD, and prevention of gaming.

Because an issue generally must be raised in comments to be preserved, comments should press every position that matters now. Positions not stated now will be hard to press later. Where Congress expressly told the Secretary to “specify” or “determine” a matter, courts generally treat that as a delegation of discretion, reviewing the agency for reasoned decision-making rather than deferring to its reading of the statute under Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024).

The priorities below are the asks with the highest likely impact:

1. Cost-sharing mechanics (§ 422.124). Replace the enrollee-favoring default with a reasonable-efforts standard supported by documented efforts. Name the controlling clock for payment requests and conform the verbal-request rule to § 422.568(a)(2). Narrow the 10-year surviving contract term and retention period and consider an auditable log in place of daily directory snapshots.
2. Provider-originated data and non-response. Request a reliance safe harbor for provider attestations and NPD-originated data, which CMS has invited by asking for “specific mechanisms for an effective technology-based safe harbor.” Treat a provider that does not respond after specified outreach as “unable to verify” rather than “inaccurate” for scoring, and provide for replacement of non-responders. Continue the NPPES compliance safe harbor for at least the initial years.
3. Scoring parameters and comparability. Put the parameters in the regulation or publish them before bids. That includes a sample-size floor with a “not scored” status below it, a common sampling window or CMS-supplied sample frames, non-response and replacement rules, confidence bands near grade cliffs, and a statement that a grade is informational and not by itself a compliance trigger. Standardization offers a lower-cost alternative to the third-party certification CMS is considering, and it addresses CMS’s stated concern about variability in implementation.
4. Timing. Add “for contract year 2028 and subsequent contract years” to every undated provision, citing § 422.521, which bars CMS from imposing a new significant cost or burden other than at the start of a calendar year unless a statute requires otherwise. Defer CMS-originated additions (the ownership disclosure, the archive retention period, and the surviving contract term) to contract year 2029, and release draft guidance with the final rule.

The scope items (the 12-month facility cycle, the removal trigger, cost plan, employer group, and D-SNP treatment, and the ownership disclosure) are also worth raising, along with the Paperwork Reduction Act question, which asks CMS to confirm that no penalty attaches to the accuracy report before the collection displays a valid OMB control number (see 44 U.S.C. § 3512).

Other areas for which CMS proposed alternate approaches are described in Figure 1.

Figure 1: Click here to open in a new window.

Where we expect more and less traction. Process and timing fixes, safe harbors for NPD and provider-attested data, the facility cadence, and technical corrections have the best prospects of changes in response to public comment. CMS is likely to hold firm on the statutory architecture (the public grade, the cost-sharing cap, and the behavioral health focus) and on its beneficiary-protection and transparency priorities. Support for partial-credit scoring and the rural and extreme-access-county adjustments would soften cliff effects. Ask CMS to provide supporting data before expanding the 35 percent band or weighting specialties more heavily. Be cautious about asking CMS to narrow the use of internal plan data, because CMS could respond by restricting it, which would lower scores. Recognize that CMS is inclined against a broad low-enrollment exception, so frame that request around small organizations that offer special needs plans.

Actions Medicare Advantage Organizations Should Take Now

From the outset, each MA organization should immediately identify (i) who will lead its effort to submit comments to CMS; (ii) which of the topics above matter most to its plan(s); and (iii) what data it can contribute before December 15, 2026. At the same time, MA organizations should begin to consider and plan the following steps now:

• Inventory directory data sources and workflows against the 90-day cycle: which elements can be verified from internal data or claims, which require provider outreach, and what response rates you achieve today.
• Run a baseline accuracy test using the proposed sampling and weighting, with behavioral health tracked separately, to estimate where each plan’s grade would fall.
• Map provider contracts and amendment paths for the new data-maintenance and appointment-documentation terms, including delegated groups and holdouts, and sequence the notices required by § 422.202(a) before the January 1, 2028, amendment deadline.
• Verify if current systems can show whether any provider was listed on any given date, and price the retention options.
• Design the cost-sharing workflow: intake, archive lookup, provider outreach, decision timeframes, refunds, maximum out-of-pocket accounting, and notices. Do not build the process around the preamble’s “never in the network” example.
• Model the contract year 2028 bid effect of directory operations, the cost-sharing differential, and payment to non-contracted providers.
• Reconcile the directory, network adequacy tables, § 422.111(m) submission, and API data, and review the annual attestation process.
• If your organization offers cost plans, employer group plans, or D-SNPs, confirm how the requirements apply and raise any gaps in comments.
• Plan marketing review for any use of a directory grade.

* * * *

For additional information about the issues discussed in this Insight or if you would like assistance from Epstein Becker Green in preparing comments to the proposed rule, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.

ENDNOTE

[1] Neither data set describes every plan type the rule would reach. The OIG study covered Medicaid managed care as well as MA, and CMS’s reviews excluded special needs plans (SNPs), employer group plans, private fee-for-service plans, cost plans, PACE, and Medicare-Medicaid plans.