Technical Reference
How the Adequacy Engine Works
A full accounting of the regulatory framework, data sources, scoring methodology, and confidence model behind every Blueprint adequacy score.
Section 1
County Classification Framework
CMS and state regulators assign every U.S. county to a classification tier that determines which adequacy standards apply. Blueprint uses the official CMS county classification for MA scoring, state-specific classifications for Medicaid, and FFM/SBE classifications for QHPs. Misclassifying counties — applying Urban standards where Rural applies — is a common source of false-passing networks.
Metropolitan Statistical Areas (MSAs) with population density ≥ 1,000 per sq. mile or large urban cores per CMS designation
Typical coverage: ~30% of counties
MA Standard
Strictest — shortest drive-time thresholds, highest minimum provider counts
Example PCP threshold
15–20 min drive / 5–10 miles (PCP)
Micropolitan areas and counties adjacent to MSAs with moderate population density per CMS classification matrix
Typical coverage: ~35% of counties
MA Standard
Moderate — intermediate thresholds, often 1.5× Urban drive-time allowance
Example PCP threshold
25–30 min drive / 15–20 miles (PCP)
Non-metropolitan counties, frontier counties, and federally designated Health Professional Shortage Areas (HPSAs)
Typical coverage: ~35% of counties
MA Standard
Most permissive — longest drive-time allowances, lowest minimum counts; exception basis most viable
Example PCP threshold
45–60 min drive / 40–60 miles (PCP)
Classification matters for exceptions. Rural counties are far more likely to qualify for CMS exception relief (documented recruitment attempts, unique geography). Blueprint scores your exception viability before you start contracting so you can decide which gaps to pursue vs. which to document.
Section 2
Regulatory Standards by Line of Business
Each LOB is governed by a distinct regulatory framework with different submission paths, standard-setters, and review timelines. Blueprint scores each LOB independently and never conflates MA adequacy standards with Medicaid or QHP requirements.
Medicare Advantage
42 CFR § 422.116CMS publishes annual HSD Reference Files listing minimum provider counts and time/distance standards for each specialty-county class combination. Plans must meet the higher of the count standard or the time/distance standard. Standards are reviewed via HPMS Network Management Module (NMM) during initial application and annual bid.
Submission path
Provider counts
Per-specialty minimums set in HSD Reference File by county class (Urban/Suburban/Rural). Counts use NPI-deduplicated, taxonomy-matched provider locations.
Time/distance
Maximum drive-time (minutes) and straight-line distance (miles) from any enrollee residence to closest network provider. CMS thresholds are tighter for Urban counties.
Facility types
Hospitals, SNFs, dialysis centers, home health agencies each have separate adequacy standards tracked independently from professional providers.
HSD submission format
CMS accepts HSD tables as structured Excel/CSV uploads to HPMS NMM. Each row = one specialty × county combination with provider NPI list and credited count.
Key caveats
Telehealth-only providers may not satisfy time/distance standards without CMS waiver.
Providers must have executed contracts — LOIs and pending agreements do not count toward adequacy.
Ghost providers (contracted but not seeing members) can trigger deficiency findings post-submission.
Section 3
HSD Specialty Crosswalk
CMS Health Service Delivery (HSD) tables require plans to credit providers by specialty using a defined taxonomy mapping. Blueprint maps NUCC provider taxonomy codes to HSD specialty codes so contracted rosters are credited correctly — not under-counted due to taxonomy mismatches, and not over-counted due to duplicate NPI entries.
| Specialty | HSD Code | Primary Taxonomies | Notes |
|---|---|---|---|
| Primary Care (PCP) | 001 | 207Q00000X, 208D00000X, 207R00000X | Internal medicine, family practice, general practice — all credited as PCP |
| OB/GYN | 015 | 207V00000X | Gynecologic oncology credited separately; midwives counted at 0.5 PCP equivalent in some states |
| Cardiology | 010 | 207RC0000X, 207RE0101X | Interventional cardiology tracked as a subspecialty with separate HSD line in some plan years |
| Behavioral Health | 026 | 101YM0800X, 103TC0700X, 2084P0800X | MA requires separate adequacy lines for Psychiatry, Therapy; Medicaid often aggregates BH |
| Orthopedic Surgery | 020 | 207X00000X | Spine surgery may be reported separately for high-volume markets |
| Oncology | 016 | 207RX0202X, 2086S0122X | Medical + radiation + surgical oncology tracked independently; proximity to NCI-designated centers preferred |
| Hospital (Acute) | H01 | 282N00000X | All licensed acute-care beds; Critical Access Hospitals credited at full weight regardless of size |
| Skilled Nursing Facility | H03 | 314000000X | Certified beds, not licensed beds; staffing ratios may reduce credited capacity in some state rules |
Partial list — Blueprint's full taxonomy crosswalk covers 47 HSD specialty lines and 280+ NUCC taxonomy codes. Updated annually at each CMS HSD Reference File release.
Section 4
Drive-Time Computation Engine
CMS tests network adequacy by asking: "Can the nearest in-network provider be reached within the applicable time or distance threshold?" Blueprint computes this at the census-tract level, then rolls up to county, ensuring our results match the actual CMS NMM evaluation methodology.
Enrollee population grid
Blueprint maps enrollee ZIP code centroids to census tract population-weighted centroids. For prospective plans, we use actual county population distribution from ACS 5-year estimates.
Provider location normalization
NPI records are geocoded via NPPES practice address. Multiple practice locations per NPI are each evaluated independently — a provider at two sites gets two geocoded points.
Drive-time matrix computation
We compute door-to-door drive-time using road network distance (not straight-line Haversine). CMS allows straight-line distance as an alternative — we calculate both and apply the standard that governs your LOB/state.
Closest-provider assignment
For each population point, the single closest in-network provider per specialty is identified. The CMS adequacy test is whether 90% of enrollee population points are within the applicable threshold.
County-level rollup
Results are aggregated to the county level. A county passes adequacy if both the count standard (minimum provider NPI count) and the access standard (90th-percentile drive-time) are satisfied simultaneously.
Gap identification and targeting
Counties failing either standard are flagged as gaps. Blueprint then runs a recruitment targeting analysis: which providers in the county or adjacent counties, if contracted, would flip the county from failing to passing.
CMS tolerance: A county passes the time/distance standard if at least 90% of the county's population lives within the applicable threshold of a contracted provider. Blueprint reports both the pass/fail result and the actual 90th-percentile drive-time so you know how much buffer you have.
Section 5
Three-Tier Data Pipeline
Blueprint builds adequacy scores from three data tiers, each adding precision. Tier 1 establishes the market landscape. Tier 2 layers your plan's actual roster. Tier 3 validates with activity evidence. Each tier produces actionable output independently — you don't need all three to start.
Tier 1
Public Intelligence
Inputs
- ·CMS HSD Reference File
- ·NPPES / NPI Registry
- ·Exchange PUFs
- ·Provider Directory APIs
Outputs
- Market capacity by county + specialty
- Competitor network maps (for benchmark)
- Baseline adequacy thresholds loaded
Tier 2
Plan Roster Overlay
Inputs
- ·Client contracted roster (CSV/API)
- ·HSD Table submission draft
- ·Transparency in Coverage files
Outputs
- County adequacy score per specialty
- Pass / At Risk / Failing classification
- Recruitment gap targeting list
Tier 3
Verification + Exception
Inputs
- ·Claims / Encounter data
- ·Provider attestations
- ·Exception evidence documentation
Outputs
- Ghost-provider flags
- Verified active-provider credits
- Exception packet export (CMS format)
Section 6
Data Source Catalog
Every data source Blueprint uses is documented below with its publisher, public URL, access method, and update cadence. We believe complete data transparency is a prerequisite for trust — you should know exactly where every number in a Blueprint score comes from.
CMS HSD Reference File
Centers for Medicare & Medicaid Services (CMS)
Access
Free ZIP download — no registration required
Update cadence
Annual (released each December for upcoming plan year)
Contents
County-level minimum provider counts by specialty and county class; maximum time/distance thresholds for Medicare Advantage plans.
How Blueprint uses it
Primary adequacy threshold reference for all MA scoring. Every county × specialty pass/fail determination is measured against this file.
Public URL
cms.gov/medicare/health-plans/medicareadvtgspecratestats
NPPES / NPI Registry
CMS / National Plan & Provider Enumeration System
Access
Free bulk download (no registration) + REST API (no key required)
Update cadence
Full monthly file + weekly delta updates
Contents
All active NPIs, provider names, taxonomy codes, practice addresses, secondary locations, and licensure for every provider in the US.
How Blueprint uses it
Provider identity validation, taxonomy-to-HSD-specialty mapping, practice location geocoding, NPI deduplication across contracted rosters.
Public URL
download.cms.gov/nppes/NPI_Files.html · npiregistry.cms.hhs.gov/api
CMS Provider of Services (POS) File
Centers for Medicare & Medicaid Services (CMS)
Access
Free CSV download via data.cms.gov — no registration required
Update cadence
Quarterly
Contents
CMS-certified hospitals, ASCs, HHAs, hospices, SNFs, dialysis centers — certification status, accreditation, bed counts, service types, practice location.
How Blueprint uses it
Facility-level adequacy scoring — hospital, SNF, HHA, and dialysis network gap identification separate from professional providers.
Public URL
data.cms.gov — provider-of-services-file-hospital-non-hospital-facilities
CMS Exchange Plan Attribute Public Use Files (PUFs)
CMS / Center for Consumer Information & Insurance Oversight (CCIIO)
Access
Free download via data.cms.gov — no registration required
Update cadence
Annual (plan year release)
Contents
QHP plan attributes, service areas, network IDs, network URLs, metal levels, benefit design, and issuer identifiers for all marketplace plans.
How Blueprint uses it
QHP service area verification, network URL validation, Exchange plan adequacy baseline, benchmark comparison for QHP issuers.
Public URL
data.cms.gov — marketplace-puf collection
Transparency in Coverage Machine-Readable Files
Each insurance issuer (required by 45 CFR Part 158); index at data.cms.gov/toc
Access
Publicly accessible per federal mandate — no registration required
Update cadence
Monthly (issuers required to update)
Contents
In-network negotiated rates by NPI and billing code; out-of-network allowed amounts. Published by every issuer with 50+ enrollees.
How Blueprint uses it
Identify which providers are actively participating in plan networks (billing activity) vs. listed-only; supplement for ghost-network detection.
Public URL
Each issuer hosts their own files — CMS publishes a machine-readable index
OIG List of Excluded Individuals/Entities (LEIE)
HHS Office of Inspector General
Access
Free CSV/DBF download — no registration required; daily supplement file available
Update cadence
Monthly full file + daily supplemental updates
Contents
All providers and entities excluded from federal healthcare programs — name, NPI, exclusion type, state, and exclusion date.
How Blueprint uses it
Exclusion screening against every contracted roster upload. Excluded providers are flagged before submission — an excluded provider in a CMS adequacy submission is a critical finding.
Public URL
oig.hhs.gov/exclusions/exclusions_dldb.asp
SAM.gov Exclusions Database
General Services Administration (GSA)
Access
Free bulk download or REST API — free API key (instant registration at sam.gov)
Update cadence
Daily updates
Contents
Federal debarment, suspension, proposed debarment, and voluntary exclusion. Broader than OIG — covers all federal program disqualification, not only healthcare.
How Blueprint uses it
Supplemental federal exclusion check. Catches debarments that do not appear on the OIG LEIE. Blueprint checks both lists for every contracted provider.
Public URL
sam.gov/data-services/Exclusions · api.sam.gov
HRSA HPSA and MUA/P Designations
Health Resources & Services Administration (HRSA)
Access
Free shapefiles and CSV downloads + RESTful API — no registration required
Update cadence
Quarterly updates
Contents
Health Professional Shortage Areas (primary care, dental, mental health) and Medically Underserved Areas/Populations — geographic boundaries, shortage scores, and designation type.
How Blueprint uses it
Exception eligibility flagging. Counties with active HPSA or MUA designations are automatically flagged as exception-viable in Blueprint gap reports — supporting documentation that regulators accept as evidence of limited provider supply.
Public URL
data.hrsa.gov/maps/map-tool · data.hrsa.gov/api/download
CMS MCPAR Public Use Files
CMS / Medicaid.gov
Access
Free CSV download — no registration required
Update cadence
Annual (2023–2024 files now public; NAAAR filings begin July 2026)
Contents
Managed Care Program Annual Reports — network adequacy assurances, access metrics, and self-reported compliance by state and plan for Medicaid MCOs.
How Blueprint uses it
Medicaid adequacy peer benchmarking. Shows how other plans in the same state reported adequacy, which specialties had challenges, and what waiver patterns exist.
Public URL
data.medicaid.gov — managed-care-program-annual-reports
Census TIGER/Line Shapefiles + ACS Population Data
U.S. Census Bureau
Access
Free shapefile download + Census API (free key at api.census.gov/data/key_signup.html)
Update cadence
Annual shapefiles; 5-year ACS estimates updated annually
Contents
Road network geometry (for drive-time routing), ZIP Code Tabulation Areas (ZCTAs), census tract boundaries, population counts, density, and demographics.
How Blueprint uses it
Drive-time routing base layer; population-weighted enrollee distribution for 90th-percentile access testing; county boundary and classification mapping.
Public URL
census.gov/geographies/mapping-files/tiger-line-file.html · census.gov/data/developers.html
Contracted Provider Roster
Health plan (client-supplied)
Access
Client-supplied — CSV, Excel, or API feed from contracting system
Update cadence
As-needed — plan can upload updated rosters at any point in the build
Contents
Fully executed contracts with provider NPI, specialty, practice location, effective date, network ID, and credentialing status.
How Blueprint uses it
Tier 2 adequacy scoring. Only executed contracts are credited — LOIs and pending agreements are tracked in the CRM pipeline but not counted toward adequacy.
Claims / Encounter Data
Health plan (client-supplied, Tier 3 only)
Access
Client-supplied under Business Associate Agreement — required before any PHI is transmitted
Update cadence
Typically a 12-month lookback at build initiation; refreshed quarterly
Contents
Member encounter records confirming which contracted providers are actively seeing members. Used to identify ghost providers — contracted but with zero patient volume.
How Blueprint uses it
Ghost-provider detection and provider capacity confirmation. De-identified activity flags (not full claims records) are sufficient for most ghost-network checks.
All public sources listed above are freely accessible to any organization. Blueprint's value is in the integration layer — loading, normalizing, cross-referencing, and applying these sources to your specific service area, LOBs, and contracted roster so you don't have to manage eleven separate data pipelines yourself.
Section 7
Confidence Scoring Model
Every adequacy score Blueprint generates comes with a confidence rating — a composite measure of how much we trust the underlying data and computation. A county score of 82% backed by verified claims and a fresh HSD file is a very different signal than 82% backed only by NPPES records and a year-old Reference File.
30%
weight
Data freshness
HSD Reference File vintage (current vs. prior year), NPPES update date, client roster upload date. Older data reduces confidence.
25%
weight
Provider verification
Verified via claims activity (high), provider directory attestation (medium), or NPPES record only (low). Ghost-provider risk increases with unverified providers.
20%
weight
Geocoding quality
Address match quality from NPPES → geocoder. Exact match (high), interpolated match (medium), ZIP-centroid fallback (low).
15%
weight
HSD rule completeness
Whether state/federal HSD standards for your service area are fully loaded. States with pending or draft standards reduce confidence.
10%
weight
Panel status validation
Whether contracted providers have confirmed open panels. Closed-panel providers increase scoring uncertainty.
Confidence bands
High (80–100)
Verified providers, current HSD file, road-network drive-time. Use for final submission review.
Medium (55–79)
Mix of verified and unverified providers. Use for internal planning and prioritization.
Low (< 55)
Significant data gaps. Results are directional — invest in Tier 3 verification before relying on scores.
Section 8
Compliance & Data Handling
Blueprint handles provider network data — not member PHI. Most adequacy workflows use only contracted roster data (provider names, NPIs, specialties, practice addresses), which is business data, not Protected Health Information. When plans choose to supply claims or encounter data for Tier 3 verification, separate data handling applies.
Routine adequacy scoring
No BAA required- Uses NPI-level provider data only (business data, not PHI)
- CMS public files (HSD Reference File, Exchange PUFs, NPPES) are publicly available
- Contracted roster contains provider, not member, records
- Drive-time computation uses county population centroids, not member addresses
Tier 3: Claims/encounter verification
BAA required- Claims data may contain member-level PHI depending on extraction format
- Blueprint executes a Business Associate Agreement (BAA) before ingesting any claims
- De-identified encounter data (HIPAA Safe Harbor or Expert Determination) does not require BAA
- Blueprint recommends de-identified encounter-level activity flags rather than full claims
Blueprint Network Hub is not a HIPAA-covered entity. We are a business associate when processing PHI on behalf of covered entities. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Security questions? Contact mike@fusion-advisory.com.
See the engine run on your service area
A Blueprint Managed Feasibility Report applies everything on this page to your actual counties, roster, and LOBs — delivered in 5 business days.