Policy brief · For MA plans, payer ops, and the CMS scoring methodology RFC
REAL Health Providers Act — an independent audit substrate
HR 7148 § 6220 — the Requiring Enhanced & Accurate Lists of Health Providers Act — was signed into law on 2026-02-03. Medicare Advantage plans must verify every provider record every 90 days, remove departed providers within 5 business days, and submit an annual accuracy analysis to HHS. Starting with plan year 2029, CMS will publish each plan's accuracy score in a machine-readable format on cms.gov.
The hard part is not the cadence. It is the measurement methodology: a plan that grades its own homework can score itself 99% by counting field-level confirmations against its own data. A plan measured against external ground truth scores very differently. CMS has not yet defined which approach the 2029 published score will use.
AINPI is a public, reproducible, record-level cross-source verification substrate for the exact decomposed metrics § 6220 requires. This page maps each obligation to the existing AINPI signal that measures it, and provides citation language for plans and submitters to the 2028 rulemaking.
Compliance window: plan year 2028 · Public scoring: plan year 2029
Eugene Vestel — Founder, FHIR IQ · Health interoperability consultant
BioLinkedIngene@fhiriq.com· Last reviewed 2026-06-02
What § 6220 actually requires
| Obligation | Specifics |
|---|---|
| Verification cadence | Every 90 days for individual providers. Every 12 months for hospitals and facilities. Unverified providers must be explicitly flagged in the directory. |
| Removal timeline | Within 5 business days of determining a provider is no longer in network. Applies to both online and printed directories. |
| Required fields | Name, specialty, contact information, primary office/facility address, new-patient acceptance, disability accommodations, cultural and linguistic capabilities, telehealth capabilities. |
| Annual accuracy analysis | Random sample of providers. Oversampling of high-error specialties (mental health, substance use disorder). Findings and accuracy score reported to HHS. |
| Public scoring (2029) | Each plan's accuracy score must be displayed prominently in its directory. HHS will publish scores in machine-readable format on cms.gov. |
Source: HR 7148, Consolidated Appropriations Act 2026 § 6220. Compliance begins plan year 2028. Public scoring begins plan year 2029.
The unresolved measurement question
CMS has not yet defined how the 2029 published accuracy score is calculated. Three measurement paradigms compete:
- Field-level on plan-owned data. Count fields that the plan can confirm internally as correct. Easiest to implement; produces scores in the high-90s. Cannot detect a plan's own data being wrong because it is the plan's own definition of correct.
- Phone-audit secret shopper. The methodology behind the Senate Finance Committee's May 2023 finding of 80%+ ghost networks in mental health. Catches real patient access failures but creates administrative burden, scales poorly, and lags reality by months.
- Cross-source intersection. Provider-owned reality (NPPES, PECOS, provider-attested location and availability) joined to payer-owned reality (active contract, effective dates, claims observation). Scored at record level against independent sources of truth.
Decomposed cross-source scoring is the only approach a plan cannot grade itself on. It is what AINPI implements. It is also what § 6220's eight required fields — taken together — most naturally map to.
How AINPI maps to each obligation
| § 6220 obligation | AINPI signal |
|---|---|
| 90-day verification cadence | AINPI ingests every public NDH release (2026-04-09 and 2026-05-08 archived to date) and computes per-NPI delta. The in-development landscape view shows median meta.lastUpdated age per state × specialty cell. A plan whose median freshness exceeds 90 days fails the cadence test independently of its own attestation. |
| 5 business day removal | Per-NPI history view (in development) cross-references each practitioner across NDH releases. NPIs disappearing from one source while persisting in a plan's directory are the audit signal. The H18 temporal-staleness finding is the public methodology. |
| Required-field completeness (8 fields) | AINPI's H6–H8 and H9–H13 measure presence and validity of name, NPI, specialty taxonomy, and address fields. New-patient acceptance, ADA accommodations, cultural / linguistic, and telehealth fields are scoped into the landscape's Completeness layer. |
| Annual accuracy analysis | AINPI's pre-registered H1–H42 hypothesis catalog is already a structured, reproducible accuracy analysis. Each finding carries methodology_version, commit_sha, generated_at, and a primary-source verify URL per flagged NPI. The L0–L7 trust scoring framework documented at /methodology decomposes the score into independently citable dimensions. |
| MH / SUD oversampling | The H29–H36 claims-side cross-audit already filters by taxonomy. Mental-health and SUD specialties can be sliced cleanly from the same pipeline; the existing per-state audit slice generator (analysis/state_findings.py) is the template. |
| Machine-readable score format (2029) | The public /api/v1 contract is already machine-readable. Each finding is a typed JSON file with stable URLs that downstream consumers (regulators, plans, researchers) can pin to a specific release tag for reproducibility under audit. |
Six decomposed dimensions
A single accuracy percentage is not auditable. AINPI publishes six independently citable dimensions, each backed by a primary source. A plan can be strong on one and weak on another; both signals matter to CMS, the patient, and the regulator.
| Dimension | What it measures | Primary source |
|---|---|---|
| Completeness | All 8 required fields present on the record | NDH bulk file |
| Correctness | Field values agree across NPPES, PECOS, NDH, and payer FHIR directories | NPPES, PECOS, payer FHIR |
| Currency | Days since the record was last updated by its publisher | meta.lastUpdated |
| Reachability | Whether the managing organization's FHIR endpoint actually responds | H1–H5 endpoint probe |
| Integrity | Record is not flagged by federal exclusion databases | OIG LEIE, SAM.gov, NPPES deactivation |
| Exposure | Record does not leak PII patterns (SSN, etc.) that should not appear in a directory record | H27 PII exposure scan |
Each dimension is computed at record level, not field level. A plan that scores 99% on Completeness but 60% on Correctness is describing a different failure mode than one with the reverse, and both deserve to be visible in the public score.
Citation language for the 2028 scoring methodology RFC
Suggested verbatim text for CMS / HHS rulemaking submissions on how the public accuracy score should be computed:
The published plan accuracy score required under HR 7148 § 6220 should be computed at record level against external sources of truth, not at field level against plan-owned data, and should be decomposed into independently citable dimensions (completeness, cross-source correctness, currency, reachability, integrity, exposure) rather than collapsed to a single percentage.
The open AINPI methodology framework (Vestel, FHIR IQ), distributed under Apache-2.0, implements record-level cross-source verification of the federal CMS National Provider Directory against NPPES, PECOS, OIG LEIE, SAM.gov, and live payer FHIR directories. It produces typed, versioned JSON with primary-source verify URLs per record at
https://ainpi.dev/api/v1/findings/<slug>.json.The framework is independent of any plan or vendor and is offered as a reference implementation for the 2029 public scoring requirement. Underlying code, methodology version, and audit trail are public at
https://github.com/FHIR-IQ/AINPI.
Pin to a specific release tag (e.g. github.com/FHIR-IQ/AINPI/releases/tag/v1.0.0) for reproducibility under audit.
Honest limitations
- AINPI is provider-directory only. It does not measure bookability or patient access outcomes directly. Phone audit, CAHPS access data, and appointment-wait-time telemetry remain complementary inputs to a complete patient-centric accuracy framework.
- Cross-source agreement requires a published source. Plans that maintain proprietary roster data not exposed in NPPES, PECOS, or a public FHIR endpoint cannot be cross-checked by any third party. The first lever for accuracy is provider-sourced data published in interoperable form.
- SSA Death Master File is not yet ingested. The Limited Access DMF requires SSA certification; AINPI currently relies on NPPES deactivation as a proxy.
- The CMS Preclusion List is not public. AINPI cannot measure exposure on it. MA plans have direct access and should report monthly.
- Flags here are data-quality signals, not investigative findings. Nothing on this site implicates fraud evidence on individual providers. A SAM.gov match on an NPI field requires NPPES name-match verification before any audit referral, per the 2026-05-22 H40 worked example.
For MA plan ops, regulators, and CMS scoring methodology submitters
If you are preparing a comment for the 2028 CMS scoring methodology rulemaking, building a plan accuracy program against § 6220, or need a state-scoped or plan-scoped accuracy slice run against an open methodology, contact gene@fhiriq.com. The methodology stays free under Apache-2.0; bespoke implementation work is a separate engagement through FHIR IQ.