Provider directory accuracy is a shared legal duty. Under the No Surprises Act, commercial health plans must verify directory data at least every 90 days and post updates within 2 business days, while providers must send updates when a contract starts or ends, when details change, and when a plan asks. Medicare Advantage and Medicaid plans follow separate CMS rules.
What does the No Surprises Act require health plans to do?
Group health plans and insurers must verify and update every provider's directory information at least once every 90 days, under 42 U.S.C. 300gg-115 (section 2799A-5 of the Public Health Service Act). They must post information a provider sends within 2 business days and have a procedure for removing providers they cannot verify within a period the plan sets. These No Surprises Act provider directory rules apply to plan years beginning on or after January 1, 2022.
When a member asks by phone or online whether a provider is in network, the plan must answer within 1 business day and keep the communication in the member's file for at least 2 years. If a member relies on a wrong listing or answer and sees an out-of-network provider, the plan may charge no more than in-network cost sharing and must count it toward the in-network deductible and out-of-pocket maximum. Until the federal departments issue regulations, their August 2021 guidance tells plans to use a good faith, reasonable interpretation of the statute.
What do provider groups owe health plans under the No Surprises Act?
Under 42 U.S.C. 300gg-139, providers and facilities must have business processes that send directory information to plans when a network agreement begins, when it ends, and when the information changes materially. CMS training on the law adds any other appropriate time, including when a plan asks. The content is basic: name, address, specialty, phone number, and digital contact information for each clinician, plus name and contact details for each group, clinic, or facility.
Errors can cost the practice. If a patient relies on a wrong listing, the practice bills more than in-network cost sharing, and the patient pays, the practice must refund the excess with interest. CMS also notes that a provider may require, in a contract or its termination, that the plan drop the provider from the directory when the contract ends and bear financial responsibility for wrong network status information, so ask for both terms in writing.
How do Medicare Advantage directory rules work?
Medicare Advantage plans answer to CMS, and the main clock is 30 days. Under 42 CFR 422.2267(e)(11), online directories must be updated within 30 days of receiving information that requires an update, and the public directory API required by 42 CFR 422.120 must reflect new information within 30 calendar days. CMS's Medicare Managed Care Manual (chapter 4, section 110.2.2) also tells plans to contact providers quarterly about accepting new patients, street address, phone number, and other changes that affect availability, and it says confirming that a group is accepting new patients is not enough.
The newest layer is 42 CFR 422.111(m), added by a September 2025 final rule. For plan years beginning on or after January 1, 2026, plans must make directory data available to CMS for publication online, update it within 30 days of learning of a change, and attest at least annually that it is accurate. In a September 2026 Q&A, CMS set September 18, 2026 as the first attestation deadline, scheduled the data to go live on the 2027 Medicare Plan Finder on October 1, 2026, and said a record with a record-level error stays hidden on Plan Finder until the plan fixes it.
What must Medicaid managed care directories show, and who checks them?
Under 42 CFR 438.10(h), Medicaid managed care plans must publish a searchable electronic directory showing, among other details, each provider's street address, phone number, specialty, whether they accept new enrollees, and whether they offer covered services by telehealth. Electronic directories must be updated within 30 calendar days after the plan receives new information.
The April 2024 managed care final rule adds outside testing. Under 42 CFR 438.68(f), states must hire an independent entity to run annual secret shopper surveys that check active network status, street address, phone number, and new-enrollee status for primary care, OB/GYN, and outpatient mental health and substance use disorder providers, plus one type the state picks. The surveyor reports errors to the state within 3 business days, the state passes them to the plan within 3 business days of receipt, and the plan fixes them within its normal update timeframes.
The surveys start with rating periods beginning on or after July 9, 2028. The rule's 10-business-day limit on routine outpatient mental health and substance use disorder appointments starts a year earlier, with rating periods beginning on or after July 9, 2027.
What did the OIG find about ghost networks?
The HHS Office of Inspector General found that many listed behavioral health providers saw no plan enrollees at all: an average of 55 percent in Medicare Advantage networks and 28 percent in Medicaid managed care. Its October 2025 data brief (OEI-02-23-00540) covered 60 plans, four Medicare Advantage and two Medicaid managed care plans in each of 10 counties across five states, and counted a listed psychiatrist, psychologist, or clinical social worker as inactive if encounter data showed no service to that plan's enrollees in 2023. One Medicare Advantage plan listed 356 providers, and only 3 of them saw an enrollee.
OIG then surveyed a random sample of inactive providers and estimated that 72 percent should not have been listed. The top reason was location: 46 percent did not work at any listed address, including one clinician listed at 19 locations who, a receptionist said, had retired years earlier. Another 21 percent did not accept patients from that plan. OIG recommended that CMS promote the use of encounter data to find inactive listings, and it cited research finding that practices update directory information for an average of 20 payers.
Who owes what for provider directory accuracy?
Commercial plans carry the 90-day verification and 2-business-day update duties, providers owe timely updates and refunds, and Medicare Advantage and Medicaid plans work on 30-day clocks, as the table below shows. Contracts and state insurance laws can set shorter deadlines, so treat these as the floor and check each state where you contract.
| Who | What | How often or how fast | Source |
|---|---|---|---|
| Commercial plans and insurers | Verify and update every listing | At least every 90 days | 42 U.S.C. 300gg-115 |
| Commercial plans and insurers | Post updates a provider submits | Within 2 business days | 42 U.S.C. 300gg-115 |
| Commercial plans and insurers | Answer member network status questions | Within 1 business day; keep records 2 years | 42 U.S.C. 300gg-115 |
| Providers and facilities | Send directory information to each plan | Contract start and end, material changes, on request | 42 U.S.C. 300gg-139 |
| Providers and facilities | Refund patients overbilled because of a wrong listing | When it happens, with interest | 42 U.S.C. 300gg-139 |
| Medicare Advantage plans | Update the online directory and directory API | Within 30 days | 42 CFR 422.2267 and 422.120 |
| Medicare Advantage plans | Contact providers about new patients, address, phone | Quarterly | Medicare Managed Care Manual, chapter 4 |
| Medicare Advantage plans | Send directory data to CMS and attest to accuracy | Updates within 30 days; attest at least annually | 42 CFR 422.111(m) |
| Medicaid managed care plans | Update the electronic directory | Within 30 calendar days | 42 CFR 438.10(h) |
| State Medicaid agencies | Run independent secret shopper surveys | Annually, from rating periods beginning July 9, 2028 | 42 CFR 438.68(f) |
What should a provider group do to keep its listings accurate?
Most directory errors start as a change the plan never heard about, so the fix is provider roster management with a routine. These habits cover most of the risk.
- Keep one roster as the source of truth. One file should hold each clinician's NPI, locations, specialty, phone numbers, telehealth and panel status, and plan participation by product. Build every plan roster from it, including any roster you send under delegated credentialing.
- Keep the CAQH profile current. CAQH (now DataSpring) says about 1,000 health plans accept its credentialing application, and its Provider Data Portal fact sheet notes that providers can authorize plans to use the profile for directories. Profiles must be re-attested every 120 days (see our guide to the CAQH attestation cycle), and providers who complete the quarterly directory confirmation are re-attesting every 90 days, according to DataSpring.
- Answer plan verification requests the week they arrive. Plans may remove providers they cannot verify, so an ignored email can quietly drop a clinician from a directory.
- Report terminations and moves within days. A departure, a closed office, or a new suite number should trigger notices to every contracted plan. Acquisitions can change tax IDs and locations for a whole roster at once; see credentialing during mergers and acquisitions.
- Treat accepting new patients as a live field. Medicare Advantage plans are told to confirm it quarterly, and Medicaid secret shoppers will test it. Change the status the day a clinician's intake closes, and change it back when openings return.
- Audit your own listings twice a year. Search each plan's public directory for your clinicians and compare the results with your roster, looking for departed providers, closed locations, and products you never signed.
OIG's review covered behavioral health listings, so those practices are a sensible place to start; our behavioral health credentialing guide covers the enrollment side. If you would rather hand off the follow-up, CredTek is a team of credentialing specialists that follows up with providers, payers, and boards on a fixed schedule and gives clients a portal to see every provider's status.
What should a health plan do to keep its directory accurate?
A plan keeps its directory accurate by making updates easy for practices and checking what they send against its own contracts, credentialing files, and claims. Each step below either saves practices work or catches what they miss.
- Publish roster intake standards. Accept one template with required fields, validate NPIs against the NPPES registry on intake, and send groups an error report instead of silently dropping bad rows.
- Reconcile rosters against contracts and credentialing files. Every listed provider should have a current contract and a credentialing record under the right group and location. Mismatches among the three are where ghost listings hide.
- Use claims and encounter data to spot inactive listings. Zero claims in a year is not proof of an error, since CMS told OIG that providers may pause and later resume seeing a plan's enrollees, but it is a reason to call the office before the next 90-day cycle.
- Route member complaints into directory fixes. Each report of a wrong number or a provider not taking patients should open a correction ticket with a deadline. Commercial members who relied on a bad listing get in-network cost sharing.
- Clear Medicare Plan Finder validation errors quickly. A suppressed record hides a contracted clinician from beneficiaries comparing plans.
Frequently asked questions
How often do health plans have to verify provider directory information?
Under the No Surprises Act, commercial group health plans and insurers must verify and update each listing at least once every 90 days and post updates a provider sends within 2 business days. Medicare Advantage plans follow CMS rules instead, with updates due within 30 days and quarterly provider outreach under CMS guidance. Medicaid managed care plans must update electronic directories within 30 calendar days.
What happens if a patient sees an out-of-network provider because the directory was wrong?
For commercial coverage, the plan can charge the patient no more than in-network cost sharing and must count that amount toward the in-network deductible and out-of-pocket maximum. The provider cannot bill the patient more than in-network cost sharing either. If the patient already paid a larger bill, the provider must refund the difference with interest.
What is a ghost network?
A ghost network is a plan directory padded with providers who are not really available to members because they retired, moved, never contracted, or do not take the plan. In an October 2025 data brief, HHS OIG found that an average of 55 percent of behavioral health providers listed by sampled Medicare Advantage plans saw no enrollees from the plan in 2023, and it estimated that 72 percent of those inactive providers should not have been listed.
Do Medicaid secret shopper surveys check provider directories?
Yes. For rating periods beginning on or after July 9, 2028, states must use an independent entity to run annual secret shopper surveys that check each Medicaid managed care plan's directory for active network status, address, phone number, and whether providers accept new enrollees. Errors reach the plan within 3 business days of the state receiving them, and the plan must fix its directory.
Does updating my CAQH profile satisfy my directory obligations?
Only for plans that actually take directory data from it. The No Surprises Act requires processes that get current information to each plan, and plans collect it in different ways, including CAQH directory confirmation, rosters, portals, and attestation emails. Keep the CAQH profile re-attested every 120 days, then ask each contracted plan which channel it treats as the official update.
See your own numbers in 60 seconds
CredTek is a team of master credentialers that plugs into your group in 48 hours and follows up with every provider, payer, and licensing board on a fixed schedule until each file is done, with your approval on every submission.
Run the ROI calculator →