Policy brief · For MA plans, payer ops, and commenters on CMS-4214-P
REAL Health Providers Act: measuring accuracy from outside the plan
HR 7148 § 6220, the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, was signed into law on 2026-02-03 as part of Public Law 119-75. From plan year 2028, network-based and certain private fee-for-service Medicare Advantage plans must verify each listed provider's directory information at least once every 90 days (up to 12 months for hospitals and other facilities the Secretary designates), remove a provider within 5 business days of determining it has left the network, and submit an annual accuracy analysis to HHS. For plan years beginning on or after January 1, 2029, HHS posts each plan's accuracy score in a machine-readable file on a CMS website, and the plan lists the score prominently on its own directory.
The hard part is not the cadence. It is the measurement methodology. A plan that checks its directory against its own records can confirm data that is wrong in both places; a check against outside sources can catch that. On 2026-10-16 CMS proposed a scoring method in CMS-4214-P: a weighted score across directory elements, reported as a letter grade. Comments are due 2026-12-15. It is a proposal, not a final rule.
AINPI checks provider records against outside sources, one record at a time, and publishes the result so anyone can re-run it. Plans analyse their own directories; AINPI measures the public federal file, so its signals are an outside reference, not the plan's analysis. This page maps each § 6220 obligation except the enrollee cost-sharing protection, which AINPI has no signal for, to the closest AINPI signal, and provides citation language for comments on CMS-4214-P.
Compliance window: plan year 2028 · Public scoring: plan year 2029
Eugene Vestel: Founder, FHIR IQ · Health interoperability consultant
BioLinkedIngene@fhiriq.com· Last reviewed 2026-10-18
What § 6220 actually requires
| Obligation | Specifics |
|---|---|
| Verification cadence | “Not less frequently than once every 90 days” for each provider listed. For “a hospital or any other facility determined appropriate by the Secretary,” at “a lesser frequency specified by the Secretary but in no case less frequently than once every 12 months.” If the plan cannot verify a provider, the directory must carry “an indication that the information of such provider may not be up to date.” |
| Removal timeline | Remove a provider “within 5 business days if the organization determines that the provider is no longer a provider participating in the network.” The duty attaches to the directory the plan must maintain “on a publicly available internet website.” |
| Directory information | “Information enrollees may need to access covered benefits,” with eight elements named as examples (“such as”): name, specialty, contact information, primary office or facility addresses, whether the provider is accepting new patients, accommodations for people with disabilities, cultural and linguistic capabilities, telehealth capabilities. |
| Annual accuracy analysis | From plan years beginning on or after January 1, 2028, an annual analysis on a random sample of the directory. The sample must include a random sample of each specialty with a high inaccuracy rate “as determined by the Secretary”; the statute says one such specialty “may be” mental health or substance use disorder treatment. The report to HHS includes an accuracy score computed with a verification method HHS specifies. |
| Public scoring (2029) | For plan years beginning on or after January 1, 2029, HHS posts accuracy scores “in a machine readable file, on an internet website maintained by the Centers for Medicare & Medicaid Services,” and each plan's score is “listed prominently on the plan's provider directory.” |
| Cost-sharing protection (2028) | If an enrollee receives a covered item or service from a provider that is not in network but was listed in the plan's directory on the date the appointment was made, the enrollee pays no more than the in-network cost sharing. Plans must tell enrollees about this protection before the annual election period (to the extent practicable), in the directory, and in the first explanation of benefits each plan year. |
Source: HR 7148 (119th Congress), Consolidated Appropriations Act, 2026, Public Law 119-75, Division J, Title II, § 6220, amending sections 1851, 1852 and 1857 of the Social Security Act. Quotations are from the enrolled bill text. Compliance begins plan year 2028. Public scoring begins with plan years on or after January 1, 2029.
The measurement question
§ 6220 leaves the method to HHS. The Secretary “shall specify plan verification methods, such as using telephonic verification or other approaches using data sources maintained by an MA organization or using publicly available data sets” (SSA § 1857(e)(6)(B)(i)), and a scoring methodology that takes into account “the administrative burden on plans and providers and the relative importance of certain provider directory information on enrollee ability to access care” (§ 1857(e)(6)(B)(ii)).
What has happened so far, as checked on 2026-10-18. CMS and ONC held the public stakeholder meeting § 6220(c)(1) requires on 2026-06-15, according to the proposed rule. On 2026-10-16 CMS issued CMS-4214-P (docket CMS-2026-2533, comments due 5 p.m. EST on 2026-12-15). It proposes verification methods (internal plan information, telephonic, e-mail, provider attestations, claims data, data sources maintained by CMS, and others CMS specifies; the preamble also proposes NPPES as one) and a weighted score: network participation 40%, specialty 10%, contact information 20%, office or facility address 20%, accepting new patients 3%, disability accommodations 3.5%, telehealth 3.5%, converted to a letter grade. For scoring, it would limit “internal plan information” to confirming network participation and specialty. The guidance to plans required by § 6220(c)(2) is due within 18 months of enactment (by 2027-08-03); none was found.
Three measurement paradigms are in play:
- Field-level on plan-owned data. Count fields that the plan can confirm internally as correct. Easiest to implement. Cannot detect a plan's own data being wrong, because it is the plan's own definition of correct, so the score it yields is likely to run high.
- Phone-audit secret shopper. The method behind the Senate Finance Committee majority staff's May 2023 study, which called 120 mental health listings across 12 Medicare Advantage plans in 6 states and found “more than 80%” were “ghosts,” meaning “either unreachable, not accepting new patients, or not in-network.” Appointments could be made for 18%. Catches real patient access failures but creates administrative burden, scales poorly, and lags reality by months.
- Cross-source intersection. Provider-owned reality (NPPES, PECOS, provider-attested location and availability) joined to payer-owned reality (active contract, effective dates, claims observation). Scored at record level against independent sources of truth.
Decomposed cross-source scoring is the only approach a plan cannot grade itself on. It is what AINPI implements. It is also what the eight directory elements § 6220 names, taken together, most naturally map to.
How AINPI maps to each obligation
| § 6220 obligation | AINPI signal |
|---|---|
| 90-day verification cadence | AINPI ingests every public NDH release and computes per-NPI delta. The warehouse holds 2026-10-07; the archive keeps 2026-05-08, 2026-08-20 and 2026-10-07 (2026-04-09 retired). The in-development landscape view shows median meta.lastUpdated age per state × specialty cell. This is a proxy, not a compliance test: § 6220 requires the plan to verify its own directory, and the NDH is not a plan directory. In the 2026-10-07 release every practitioner record carries the same meta.lastUpdated value (see H18), so the proxy cannot yet separate records. |
| 5 business day removal | Per-NPI history view (in development) cross-references each practitioner across NDH releases. NPIs disappearing from one source while persisting in a plan's directory are the audit signal. The H18 temporal-staleness finding is the public methodology. |
| Directory-information completeness (8 named elements) | AINPI's H6-H8 and H9-H13 measure presence and validity of name, NPI, specialty taxonomy, and address fields. New-patient acceptance, ADA accommodations, cultural / linguistic, and telehealth fields are scoped into the landscape's Completeness layer. |
| Annual accuracy analysis | AINPI's pre-registered hypothesis catalog is already a structured, reproducible accuracy analysis. Each finding carries methodology_version, commit_sha, generated_at, and a primary-source verify URL per flagged NPI. The L0-L7 trust scoring framework documented at /methodology decomposes the score into independently citable dimensions. |
| High-inaccuracy specialty samples (MH / SUD may be one) | The H29-H36 claims-side cross-audit already filters by taxonomy. Mental-health and SUD specialties can be sliced cleanly from the same pipeline; the existing per-state audit slice generator (analysis/state_findings.py) is the template. |
| Machine-readable score format (2029) | The public /api/v1 contract is already machine-readable. Each finding is a typed JSON file with stable URLs that downstream consumers (regulators, plans, researchers) can pin to a specific release tag for reproducibility under audit. |
Six decomposed dimensions
A single accuracy percentage is not auditable. AINPI publishes six independently citable dimensions, each backed by a primary source. A plan can be strong on one and weak on another; both signals matter to CMS, the patient, and the regulator.
| Dimension | What it measures | Primary source |
|---|---|---|
| Completeness | All 8 directory elements § 6220 names present on the record | NDH bulk file |
| Correctness | Field values agree across NPPES, PECOS, NDH, and payer FHIR directories | NPPES, PECOS, payer FHIR |
| Currency | Days since the record was last updated by its publisher | meta.lastUpdated |
| Reachability | Whether the managing organization's FHIR endpoint actually responds | H1-H5 endpoint probe |
| Integrity | Record is not flagged by federal exclusion databases | OIG LEIE, SAM.gov, NPPES deactivation |
| Exposure | Record does not leak PII patterns (SSN, etc.) that should not appear in a directory record | H27 PII exposure scan |
Each dimension is computed at record level, not field level. A plan that scores 99% on Completeness but 60% on Correctness is describing a different failure mode than one with the reverse, and both deserve to be visible in the public score.
Citation language for comments on CMS-4214-P
Suggested text for comments on the proposed accuracy scoring methodology (docket CMS-2026-2533, due 2026-12-15):
The published plan accuracy score required under HR 7148 § 6220 should be computed at record level against external sources of truth, not at field level against plan-owned data, and should be decomposed into independently citable dimensions (completeness, cross-source correctness, currency, reachability, integrity, exposure) rather than collapsed to a single percentage.
The open AINPI methodology framework (Vestel, FHIR IQ), distributed under Apache-2.0, implements record-level cross-source verification of the federal CMS National Provider Directory against NPPES, PECOS, OIG LEIE, SAM.gov, and live payer FHIR directories. It produces typed, versioned JSON with primary-source verify URLs per record at
https://ainpi.dev/api/v1/findings/<slug>.json.The framework is independent of any plan or vendor and is offered as a reference implementation for the 2029 public scoring requirement. Underlying code, methodology version, and audit trail are public at
https://github.com/FHIR-IQ/AINPI.
Pin to a specific release tag (e.g. github.com/FHIR-IQ/AINPI/releases/tag/v1.0.0) for reproducibility under audit.
Honest limitations
- AINPI is provider-directory only. It does not measure bookability or patient access outcomes directly. Phone audit, CAHPS access data, and appointment-wait-time telemetry remain complementary inputs to a complete patient-centric accuracy framework.
- Cross-source agreement requires a published source. Plans that maintain proprietary roster data not exposed in NPPES, PECOS, or a public FHIR endpoint cannot be cross-checked by any third party. The first lever for accuracy is provider-sourced data published in interoperable form.
- SSA Death Master File is not yet ingested. The Limited Access DMF requires SSA certification; AINPI currently relies on NPPES deactivation as a proxy.
- The CMS Preclusion List is not public. AINPI cannot measure exposure on it. MA plans have direct access and should report monthly.
- Flags here are data-quality signals, not investigative findings. Nothing on this site implicates fraud evidence on individual providers. A SAM.gov match on an NPI field requires NPPES name-match verification before any audit referral, per the 2026-05-22 H40 worked example.
For MA plan ops, regulators, and CMS-4214-P commenters
If you are preparing a comment on CMS-4214-P, building a plan accuracy program against § 6220, or need a state-scoped or plan-scoped accuracy slice run against an open methodology, contact gene@fhiriq.com. The methodology stays free under Apache-2.0; bespoke implementation work is a separate engagement through FHIR IQ.