Your 2028 deadline is reallyOctober 15, 2027
Provider directory accuracy is becoming a reportable, and soon public, compliance metric. The job is changing: from maintaining directories to actively verifying, measuring, and reporting accuracy.
The first compliant directory will be posted October 15, 2027.
Download PDF
Ghost networks now carry a price tag.
From plan year 2028, the plan absorbs the cost when a member relies on a wrong listing. Inaccuracy stops being a service problem and becomes a claim liability.
Error rates found in CMS audits of Medicare Advantage directories
The new window to pull a departed provider from every directory
What the REAL Act requires
90-Day Verification
Verify every provider record at least every 90 days. Documented. Timestamped. Audit-ready.
5-Day Removal
Remove providers within 5 business days of confirmed departure.
Annual Accuracy Audit
Run a random sample analysis with an accuracy score; sample must include specialties with high inaccuracy rates (mental health, substance use disorder, etc.).
Member Cost-Sharing Protection
Absorb added costs when members rely on inaccurate in-network information. Notice is required: before the annual election period, in the directory, and in the EOB.
Unverified Record Flags
Display a visible indicator on any record not verified within 90 days.
Expanded Required Fields
Carry accommodations for people with disabilities, cultural and linguistic capabilities, and telehealth capabilities.
The dates that matter.
-
Feb 2026
REAL Act signed into law.
-
Early 2027
HHS implementation guidance is due; industry commentary expects it closer to mid-2027.
-
Oct 15, 2027
The PY2028 directory posts and member cost-sharing notices go out. This is the real deadline. The work has to be finished by October 2027.
-
Jan 1, 2028
90-day clock, 5-day removals, and cost-sharing protection take effect. Accuracy audits begin and scores go public in 2029.
The PY2028 directory posts on Oct. 15, 2027. It's time to act, now.
Nobody has decided how the score will be calculated.
- Field-level checks against the plan's own records
- Confirms internal consistency, not reality
- Cannot catch a provider who moved, retired, or left the network
- Produces scores in the high 90s
- Publishes a number members will not recognize
- Cross-source checks: NPPES, provider attestation, claims activity
- Phone verification of real appointment availability
- Audit-ready documentation that catches the failures members actually hit
- Produces a lower and far more defensible score
5 moves to make now.
Establish a baseline
Measure accuracy by specialty, geography, provider type, and high-risk fields like the ones shown below.
Start with mental health and SUD, as that is where the statute points the sample.
Map your workflow gaps
Find where processes break: roster ingestion, departure detection, verification timing, downstream updates.
Determine if 5 business days is feasible.
Build audit-ready measurement
Prove when a record was verified, what changed, and what source confirmed it.
Move beyond manual attestation
90-day cycles and 5-day removals don't scale by hand. You need continuous validation.
Reopen provider contracts
2027 is the last clean window to write update obligations into provider agreements. CMS has pointed to contract terms as a legitimate way to meet the duty.
Accuracy is going public.
Today, directory accuracy is a private, internal number.
In 2029, your data accuracy will be exposed to the public.
What used to be a back-office data problem is becoming a front-door performance metric.
Continuous validation is the answer to 2028 and 2029.
Most plans aren't struggling to understand the rule. They're struggling to operationalize it. Fragmented systems, manual workflows, and slow update cycles can't hit a 90-day clock.
Candor Health treats provider data as a living asset: continuously validated across tens of thousands of sources, audit-ready, and measured on what regulators actually check, which is whether a member can reach that provider.