2026-08-01 update: half the states have a Medicaid directory you can actually open

No NDH release for 85 days. But the public repositories around the directory have been busy, and two of them turned out to be measurable. This update publishes H46, a new finding computed entirely from public data at zero cost, and a baseline measurement of the federated payer registry.

H46: state Medicaid provider directories, listed and live

CMS maintains a directory-of-directories: one row per state and territory, each either a link to that state's public Medicaid provider directory or the literal string "Not available". Section 5006 of the 21st Century Cures Act, codified at 42 U.S.C. § 1396a(a)(83), requires each state providing medical assistance on a fee-for-service basis or through a primary care case-management system to publish a directory of physicians on the state agency's public website. So the list is a reasonable place to look at how that is going.

Two layers, both measured:

Layer 1, coverage. 32 of the 51 jurisdictions (50 states plus DC) carry a directory URL. 19 states do not. None of the 5 territories do.

Layer 2, liveness. We could not find a published measurement of whether the listed URLs answer. Of the 32 listed URLs, 27 answered an ordinary unauthenticated request. Five did not:

So 27 of 51, 52.9%, have a federally-catalogued Medicaid provider directory that a member of the public can actually open. Each of the five failures was re-probed by hand on 2026-08-01 before publication.

The companion piece in the same repository, the Interoperability and Patient Access endpoint directory, is still an empty data-gathering workbook: 44 rows of questions and guidance, zero states populated.

What a state can do about it: both failure modes are cheap to fix and both are publicly visible. A missing row needs a URL sent to CMS. A broken row needs the link updated. The per-jurisdiction results, including every URL and its outcome, ship as CSV next to the finding.

Finding: https://ainpi.dev/findings/state-medicaid-directory-coverage

A measurement mistake worth reporting

The first version of this probe reported eight failures, not five. Three of those (Iowa, Rhode Island, West Virginia) were our own TLS stack rejecting certificate chains that a normal client accepts without complaint. Iowa had a second, independent bug: its URL carries an ASP.NET session token in parentheses, and the markdown-link regex truncated it at the inner bracket.

Publishing the first number would have named three states as broken when they are fine. The probe now runs through curl, follows redirects, and classifies a 403 or 429 as "refused an identified crawler" rather than "down". This is the kind of error that makes directory audits untrustworthy, so it seemed worth describing rather than quietly fixing.

The federated payer registry, before payers arrive

The Federated Payer Identifier proposal now has real contents. Payers self-enumerate by publishing a well-known index file that maps their plans to their interoperability endpoints; the repository mirrors those files so corrections can arrive as pull requests.

The registry at commit aca76142 (2026-07-24):

• 174 well-known payer index files, all under medicare_advantage. The commercial, ERISA, marketplace, and Medicaid managed-care buckets exist but contain only placeholder READMEs.
• 140 distinct payer legal names, 174 Medicare Advantage contracts, and 2,557 distinct contract-and-plan pairs enumerated.
• 0 files published by a payer. Every file has a null copied_from_url, so nothing in the registry has yet been mirrored from a payer's own well-known URL. The repository's seed-generator spec describes the current contents as generated from CMS source CSVs to serve as seed data.
• 0 endpoints. Not one file carries an endpoint entry yet.

That is the honest state of it: a scaffold with 2,557 plans enumerated and zero endpoints behind them. It is a useful baseline precisely because it is empty. When payers begin publishing, the delta is measurable from the same repository. The identifier systems in the seeded files still carry literal NotSure/WhatGoesHere placeholders, so the schema is unsettled.

The location-phone path returns nothing, and that is deliberate

A question in the public workgroup asked why phone numbers cannot be connected to locations in the NDH files: the Location resource is supposed to carry a telecom field, and it does not appear in the data.

We measured exactly this in H43. Across all 7,196,385 active practitioners, zero are reachable by a phone number through the PractitionerRole → Location traversal. Not sparse. Zero. Meanwhile 99.98% carry a phone directly on the Practitioner record. (The May release deduped Location resources by 61% against April, which lowers this path mechanically. The count was still zero.)

CMS gave the reason in the same channel: Location.telecom is 0..* in FHIR, so it is optional, and the upstream NPPES address-to-phone associations are unreliable enough that publishing them would propagate bad data. Rather than republish bad associations, they left the field off for now.

That is a defensible call. For anyone building against these files: the location-phone path does not exist in this release. Read Practitioner.telecom. The traversal adds nothing.

Finding: https://ainpi.dev/findings/practitioner-phone-reachability

Still no release

The NDH bulk-export manifest still points at the 2026-05-07 file set, 85 days after the May release. CMS said in the public NDH workgroup channel, in a notice covering the week of June 29 to July 3, that directory.cms.gov had entered a maintenance period while an enhanced version of the directory is prepared. That reads as a planned pause rather than a stalled pipeline. Every AINPI number stays pinned to the 2026-05-08 release until a new one lands.

Method and limits

H46 reads state-medicaid-provider-directories.md from Enterprise-CMCS/SMA-Endpoint-Directory, pinned at commit 8efa0c2d, and issues one GET per listed URL with an identified User-Agent and a 25-second timeout. No BigQuery, no paid API, no retry storm. The endpoint workbook in the same repository was inspected by hand at the same commit; the script does not parse it.

The important limit: "not listed" measures the CMS catalog, not the state. A state may publish a directory this list has not captured. H46 is a completeness measure of the federal directory-of-directories, not a compliance judgement about any state. Confirming an individual state's status means checking that state directly, and the CSV gives you the URL to start from.

The payer-registry counts are file and field counts at commit aca76142, reproducible with a clone and a JSON walk. The 174-files and 174-contracts figures match because the seed generator writes one file per contract.

Compute script: analysis/h46_sma_directory_coverage.py

— Eugene Vestel, FHIR IQ