A member calls to schedule an appointment. She finds a primary care physician listed in her plan's online directory, confirms the address, and drives across town. The physician retired eight months ago. The practice stopped accepting her plan's members six months before that. She calls your member services line frustrated and unserved. Three days later, a claims submission comes through for that provider's NPI — still active in your adjudication system from the old contract. The claim denies. Your network team generates a manual exception. Someone updates a record. The whole sequence costs your plan time, money, and a member complaint.

This scenario isn't unusual. A CMS national review found that 48.74% of provider locations in Medicare Advantage online directories contained at least one inaccuracy — wrong phone number, wrong address, or outdated network participation status. For Medicaid managed care, secret shopper studies have found that more than a third of listed providers were unreachable or no longer serving Medicaid patients. The directory error is rarely a single isolated fact. It propagates — into member experience, into claims adjudication, and into audit findings.

What the Regulations Actually Require

Federal directory accuracy requirements now span three distinct regulatory frameworks, each with specific update frequencies and accuracy thresholds.

Medicaid Managed Care — 42 CFR 438.10

The April 2024 Medicaid Managed Care Access, Finance and Quality final rule tightened the requirements at 42 CFR 438.10(h). Managed care organizations must update provider directory information within 30 calendar days of receiving a change notification. The rule also requires states to contract with an independent entity — separate from both the state agency and any contracted MCO — to conduct annual secret shopper surveys verifying active network status, street address, phone number, and whether providers are accepting new Medicaid enrollees. Survey results must be reported to CMS annually and posted publicly. States must notify managed care plans of identified errors within three business days of detection.

The 30-day update requirement took full effect July 1, 2025. Plans that were operating on weekly batch updates or monthly reconciliation cycles were already out of compliance on that date.

Medicare Advantage — 42 CFR 422 and the REAL Health Providers Act

MA plans must verify provider directory information at least once every 90 days and process updates within 30 days of becoming aware of changes. CMS requires a minimum 85% directory accuracy rate, with accuracy measured across practice locations, phone numbers, specialty designations, and network participation status. Plans must attest annually that their directory is accurate and complete.

The Consolidated Appropriations Act, 2026 added the REAL Health Providers Act, requiring MA organizations to conduct an annual analysis of their directory accuracy and report findings directly to CMS. Starting with plan year 2029, plans must prominently display their provider directory accuracy score within the directory itself.

CMS also finalized requirements for MA plans to submit provider directory data directly to Medicare Plan Finder for 2027 open enrollment — centralizing the data in a format CMS controls, which makes inaccuracies more visible and more auditable.

No Surprises Act

The No Surprises Act added a separate layer of directory requirements for group health plans and health insurance issuers. Plans must verify all provider directory data every 90 days, process updates within two business days of receiving information, and remove providers whose information cannot be verified within the plan's established verification period. Plans must also respond within one business day to requests confirming whether a provider is in-network for a specific service, and must retain that communication for at least two years.

These three frameworks overlap for many plans. An MA-Medicaid dual-eligible plan may be operating under all three simultaneously.

How Directory Errors Become Claims Denials

The connection between directory inaccuracy and claims denials runs through a single identifier: the NPI.

Every claim submitted to your plan carries a billing NPI — either a Type 1 (individual provider) or Type 2 (organizational) identifier. Your claims adjudication system validates that NPI against your internal provider file: Is this NPI active? Is this provider contracted? Is the service type covered under this provider's agreement?

When your provider directory contains a provider who has left the network but whose NPI has not been deactivated in the adjudication system, two problems occur simultaneously. First, members can still find and attempt to access that provider through your directory. Second, claims submitted under that NPI continue adjudicating — sometimes correctly, sometimes incorrectly depending on what other system records say.

The reverse is equally common. A new provider joins your network. Your network team updates the directory. But the NPI is not yet active in the adjudication system because the credentialing approval hasn't propagated through to the claims platform. The provider submits claims. They deny. The provider calls. Your staff manually intervenes.

Denial code CO-207 and CO-208 are the claims-level signals of this problem — provider NPI not on file, or billing NPI not matching the registered NPI with the payer. These are administrative denials, not clinical ones. They are fully preventable if directory and adjudication data stay synchronized. They are recurring and invisible if they don't.

The administrative cost to rework a single denied claim runs between $118 and $181. For a plan with 50,000 members and a modestly sized contracted network, NPI and provider data mismatches can generate dozens of these denials per week during periods of active network change — onboarding, re-credentialing cycles, contract terminations.

What Audit Findings Actually Look Like

CMS and state Medicaid agencies have sharpened their focus on directory accuracy over the last two years. The mechanisms are specific.

For MA plans, CMS conducts routine compliance audits that include directory accuracy as a scored element. Failure to meet the 85% accuracy threshold is a findings trigger. Corrective action plans are required from organizations that fall below the threshold, and CMS has established formal CAP requirements for directory accuracy as of its July 2024 guidance.

For Medicaid MCOs, the new independent secret shopper requirement is the audit mechanism states will use going forward. When a secret shopper calls a listed provider and finds that the provider is not accepting the plan's members, not reachable at the listed number, or has moved to an unlisted address, that is a data point in a scored survey. Plans that accumulate enough of those findings trigger a compliance review. The results are public.

State-level audits have also surfaced systemic issues. A January 2025 audit in Vermont identified problems in the state's oversight of Medicaid managed care programs, including provider data accuracy gaps. GAO's 2023 review of Medicaid program integrity found that nearly 60% of state audit findings were repeated from the prior year — the same problems, uncorrected. Directory accuracy is among those repeated findings.

The Difference Between Directory Maintenance and Directory Auditing

Plans often treat these as the same function. They are not.

Directory maintenance is the operational workflow: receiving provider change notifications, processing them within the required update window, reflecting changes in both the public-facing directory and the internal adjudication system. This requires a defined intake process, a maximum processing time, and a system of record that is authoritative for both directory display and claims validation.

Directory auditing is the verification function: confirming that what is in your directory matches reality. This means outbound verification — calling providers or sending attestation requests to confirm address, phone, accepting status, and network participation. It means comparing your directory data against NPPES (the National Plan and Provider Enumeration System) for NPI status. It means tracking the results of that verification and acting on discrepancies within a defined window.

The regulatory requirements implicitly demand both. The 30-day update rule is a maintenance standard. The independent secret shopper requirement is an audit mechanism the state performs on your behalf — or against you, depending on what they find.

Most small plans have some version of directory maintenance. Few have a documented, repeatable directory auditing workflow that runs independently of maintenance. The audit is what catches the errors that maintenance missed: the provider who confirmed they were still in-network six months ago but has since moved without notifying the plan, or the group practice that updated its location but whose individual providers' records were not updated individually.

The regulatory expectation is that you have both — and that you can demonstrate both through documented processes, update logs, and attestation records.

What a Compliant Directory Workflow Requires

A compliant workflow has four components that must function together.

A single system of record. Your provider directory and your claims adjudication provider file must draw from the same authoritative data source — or must have a real-time synchronization mechanism that keeps them aligned. When the directory says a provider is inactive, the claims system must reflect the same status within the required update window. When the claims system activates a new billing NPI, the directory must be updated to match. The two cannot be maintained separately on different schedules.

Defined intake and processing SLAs. Every provider change notification — whether it comes from a provider attestation, a contract termination, a credentialing re-verification, or an external source — must enter a documented workflow with a timestamp and a processing deadline. For Medicaid MCOs, that deadline is 30 days. For No Surprises Act compliance, updates to network participation status must be processed within two business days. Those SLAs must be tracked, not assumed.

Proactive outbound verification on a defined cycle. Waiting for providers to notify you of changes is not sufficient and not compliant. Your plan must conduct outbound attestation or verification at a defined frequency — quarterly is the minimum for most frameworks — and must document the results. Providers who cannot be verified must be flagged and, depending on the regulatory framework, removed from the directory.

An error detection and escalation path. When a discrepancy is identified — through a member complaint, a claims denial pattern, a failed verification, or a state survey notification — your plan must have a documented path for correcting the record within the required window and tracking the correction to completion. For Medicaid, states must notify you of errors within three business days and expect a response. That requires someone accountable for receiving and acting on those notifications.

Plans managing these workflows in spreadsheets and shared inboxes cannot reliably meet these standards during periods of network change. The manual touchpoints are where the 30-day clock gets missed, where the NPI update doesn't reach the claims system, and where the outbound verification cycle gets skipped when staff are occupied elsewhere.

If your plan's directory management workflow is overdue for a compliance review, Ayin's platform and operations services are designed to close the gap between regulatory requirements and operational reality — learn more at ayin.com/platform or reach out directly.