Medicaid Appointment Wait Time Standards: 438.68(e) and the Secret Shopper

The standards and when they start

Under 42 CFR 438.68(e), states must hold Medicaid managed care plans to maximum wait times for routine appointments: 10 business days from the date of request for outpatient mental health and substance use disorder services, 15 business days for primary care, 15 business days for obstetrics and gynecology, and a state-set timeframe for one more service the state picks. A plan is deemed compliant when secret shopper surveys show appointments available within the standard at least 90 percent of the time. The standards apply to the first rating period beginning on or after July 9, 2027. The secret shoppers who measure them arrive a year later.

Service (routine appointments, if covered in the contract)	Maximum wait from the date of request
Outpatient mental health and SUD, adult and pediatric	10 business days
Primary care, adult and pediatric	15 business days
Obstetrics and gynecology	15 business days
One additional service selected by the state "in an evidence-based manner"	Set by the state (no federal maximum)
Compliance threshold	At least 90% of secret shopper results within the standard

CMS can add service types later, after consultation and public notice (438.68(e)(3)). The matching contract requirement, 438.206(c)(1)(i), starts on the same July 9, 2027 date.

Why this is a phone-answering exercise, not a map exercise

For most of the history of Medicaid managed care, network adequacy meant geography. Time and distance, provider-to-enrollee ratios, a count of contracted primary care physicians per county. You could pass those tests from a spreadsheet. The wait-time standard cannot be passed from a spreadsheet, because it measures what happens when someone calls a front desk and asks for an appointment.

That is the whole argument of this piece, so here it is plainly: an MCO that treats 438.68(e) as a contracting clause will fail the secret shopper. Adding "provider agrees to offer routine appointments within 15 business days" to your templates is necessary. It does nothing about the phone number that rings at a billing office, the practice that closed its panel last spring, or the scheduler who has never heard of your plan.

The baseline is not encouraging. When HHS-OIG called 1,800 Medicaid managed care primary care providers and specialists in a 2014 study, 51% could not offer appointments, 35% could not be found at the listed location and another 8% were at the location but said they did not participate in the plan. Among those who did offer an appointment, the median wait was 2 weeks, and 10% of callers waited more than 2 months. That report is more than a decade old. The directory findings OIG published in 2025 and 2026, which we walk through in our piece on ghost networks, suggest the underlying problem has not gone away.

The directory test and the wait-time test also stack. If the listed number is wrong, you do not get to the question of how long the wait is.

How the secret shopper survey works under 438.68(f)

The survey has two jobs, and plans tend to prepare for only one of them.

The first is directory accuracy (438.68(f)(1)). The shopper checks the plan's most current electronic directory for four provider types: primary care, OB/GYN, outpatient mental health and SUD, and the provider type for the state-selected service. For each listing it tests, at minimum, active network status, street address, telephone number and whether the provider is accepting new enrollees. Errors move on a tight chain. The survey entity reports them to the state no later than 3 business days after finding them, the state passes them to the plan within 3 business days of receipt, and the plan must fix them within the 438.10(h)(3) timeframes, which for an electronic directory is 30 calendar days.

The second is timely access (438.68(f)(2)): each plan's rate of network compliance with the wait-time standards. Telehealth appointments count only if the surveyed provider also offers in-person appointments to the plan's enrollees, and telehealth results must be reported separately from in-person results.

The method rules are short. The state must use an entity independent of the state Medicaid agency and of the plans it surveys, meaning it is not an MCO, PIHP or PAHP and neither owns nor is owned by a surveyed plan. Surveys are annual for each MCO, PIHP and PAHP. Samples are random and must cover every area of the state in the contract, and the wait-time survey must use a "statistically valid sample of providers." The regulation does not set a margin of error or a sample size. If you have seen a 5% figure attached to this, it comes from the separate Exchange guidance, not the Medicaid rule. Results go to CMS on the 438.207(d) reporting cycle and must be posted on the state's website within 30 calendar days of submission to CMS.

Now the date. Paragraph (f) applies to rating periods beginning on or after July 9, 2028 (a CMS summary chart lists July 10). The regulation computes the date as four years after July 9, 2024, while CMS's applicability chart shows July 10 and says the final rule is the official record. For almost every state it makes no difference. If your rating period starts on July 9 or 10, get your state's reading in writing.

The dates, in order

The Access Rule (CMS-2439-F) took effect July 9, 2024, but most provisions apply to the first rating period beginning on or after a later date. The rating period is the twelve months for which capitation rates are developed, so the real start date depends on your state's contract cycle.

• July 9, 2026: the annual payment analysis (438.207(b)(3) and (d)(2)) and the requirement that network adequacy exceptions consider plan payment rates (438.68(d)(1)(iii)).
• July 9, 2027: the wait-time standards (438.68(e)), the matching contract requirement (438.206(c)(1)(i)), the updated list of provider types needing quantitative standards (438.68(b)(1)) and state publication of standards (438.68(g)).
• July 9, 2028 (CMS chart: July 10): secret shopper surveys (438.68(f)), remedy plans (438.207(f)), CMS's right to inspect shopper documentation (438.207(e)) and the duty to correct shopper-found directory errors (438.10(h)(3)(iii)).

Here is what that looks like for the two most common rating periods. This is our arithmetic, not CMS guidance. Confirm it against your state contract.

Provision	Calendar-year rating period	July to June rating period
Payment analysis, 438.207(b)(3)	January 1, 2027	July 1, 2027
Wait-time standards, 438.68(e)	January 1, 2028	July 1, 2028
Secret shopper, 438.68(f), and remedy plans, 438.207(f)	January 1, 2029	July 1, 2029

Notice the gap. In a calendar-year state, the wait-time standard binds for all of 2028, and the federally required secret shopper does not start until 2029. That year is a gift. Use it to run your own survey while the results are still yours.

Remedy plans and the payment analysis

When the state, the plan or CMS finds an area where access "could be improved," 438.207(f) requires the state to submit a remedy plan to CMS within 90 calendar days of becoming aware of the issue. The plan has to fix the problem within 12 months, with specific steps, timelines and responsible parties, and the improvement must be "measurable and sustainable." The state sends CMS quarterly progress updates. If access has not improved after 12 months, CMS can require another 12 months and revisions.

The remedy plan is the state's filing. The work lands on the MCO.

The actions the regulation lists are worth reading closely, because they tell you where CMS thinks access breaks: raising provider payment rates, better outreach and problem resolution for providers, "reducing barriers to provider credentialing and contracting," expanded telehealth, and faster, more accurate claims payment and prior authorization. Credentialing is on that list for a reason. A provider who signed in February and cannot see members until August is a provider the shopper will never reach. We cover that clock in how long provider credentialing takes.

The payment analysis arrives first. For the first rating period beginning on or after July 9, 2026, plans submit an annual analysis using paid claims from the prior rating period: total E&M payments for primary care, OB/GYN, mental health and SUD, each as a percentage of the published Medicare payment rate, with adult and pediatric reported separately where the percentages differ. Homemaker, home health aide, personal care and habilitation services are reported as a percentage of what Medicaid fee-for-service would have paid. Claims where the plan is not the primary payer, and FQHC and RHC services, are excluded. The state rolls the results up to a member-month-weighted state percentage. Our expectation is simple: once a state holds both your wait-time results and your payment percentages, it will read them side by side.

How the Exchange standard compares

Issuers on the federally facilitated Exchange have lived with wait-time standards since plan year 2025, under 45 CFR 156.230(a)(2)(i)(B). The standards first appeared in the 2023 Letter to Issuers and were delayed by the 2024 Payment Notice until PY2025. The approach carried into 2026 with a technical correction and is unchanged in the 2027 Final Letter to Issuers.

	Medicaid managed care (438.68)	Exchange QHP on the FFE
Behavioral health	10 business days (outpatient MH/SUD)	10 business days
Primary care, routine	15 business days	15 business days
Other	OB/GYN 15 business days; one state-selected service	Specialty care (non-urgent) 30 business days
Threshold	At least 90%	At least 90% of the time
Who runs the survey	An independent entity hired by the state, annually	A third party hired by the issuer (not an affiliate), finished by May 31
What is surveyed	Primary care, OB/GYN, outpatient MH/SUD, state-selected type	Primary care and behavioral health; specialty expected in future years
Telehealth	Counts only if the provider also offers in-person care to plan enrollees	The shorter of the in-person or telehealth wait is used
If you fall short	State remedy plan under 438.207(f)	Issuer "would need to add more contracted providers"
Applies from	Rating periods on or after July 9, 2027	Plan year 2025

For plans that sell in both markets, two differences matter. Medicaid's telehealth rule is stricter, so a virtual-first behavioral health group that helps your Exchange numbers may do nothing for your Medicaid numbers. And in Medicaid the state hires the shopper, so you do not control the script, the sample or the timing.

While you are comparing: the Exchange's essential community provider threshold stays at 35% overall, and separately at 35% of available FQHCs and 35% of available family planning providers. CMS proposed cutting all three to 20% for 2027 and did not finalize it. And for contrast, Medicare Advantage's standard under 42 CFR 422.112(a)(6)(i) is looser on paper: routine and preventive primary care and behavioral health within 30 business days, and 7 business days for care that needs attention but is not urgent.

A readiness checklist for 2027 and 2028

1. Get your dates in writing. Confirm your rating period start and which July 2028 date your state reads for the secret shopper.
2. Find out the state-selected service. Ask what it is, what timeframe the state set and which provider type the shopper will call for it.
3. Ask how OB/GYN will be counted. In a March 12, 2026 bulletin, CMS said states have flexibility to specify the provider types used to meet the OB/GYN standard, including family medicine physicians and certified nurse-midwives. Ask how your state will apply that.
4. Clean the four elements the shopper tests. Active network status, street address, phone number and accepting new enrollees, for every listing in the four surveyed provider types.
5. Run your own shopper in the gap year. Use a random sample that covers every region in your contract, keep telehealth results separate, and call the way a member would, from the directory.
6. Build the correction path now. Name the person who receives the state's error file and the workflow that closes each item inside 30 calendar days.
7. Take the standard to the front desk. Contract language is the floor. Schedulers need to know what counts as a routine request and that your members are welcome.
8. Audit telehealth-only listings. For Medicaid they only count if the provider also offers in-person appointments to your enrollees.
9. Run the payment analysis early. Know your E&M percentages of Medicare before the state does.
10. Write your remedy playbook before you need one. List where credentialing, contracting and claims friction slow access in your network, because those are the levers the regulation names.

The plans that pass in 2028 will be the ones that stopped counting contracts and started counting answered phones in 2027. Blueprint is the CRM network teams run a build in, with the recruiting pipeline, credentialing status and adequacy scoring against the standards you load on the same records. It does not make secret shopper calls. For a quick read on where your build stands, try the free build scorecard.