Ghost Networks and Provider Directory Accuracy: The Rules Now Have Dates

What a ghost network is, and why the rules now have dates

A ghost network is a provider directory full of listings members cannot use: providers who left the network, moved, stopped taking new patients, never see the plan's members, or cannot be reached at the number shown. For years plans treated directory accuracy as a member-experience problem. That is over. Medicare Advantage plans now submit directory data to CMS for Medicare Plan Finder under 42 CFR 422.111(m), with 30-day updates and an annual attestation, for plan years beginning on or after January 1, 2026. Medicaid plans have a 30-day update rule today and state secret shoppers testing their directories from 2028. Commercial plans carry the No Surprises Act's 90-day verification rule. And a 2026 law gives MA plans 90-day verification, 5-business-day removals and a public accuracy score starting in plan year 2028.

Our view is simple. Quarterly calling campaigns will not fix this. The cheapest place to stop a directory error is the moment the data enters your building, at roster intake, and most plans spend their money at the other end.

What the secret shoppers found

The phrase went mainstream in May 2023, when the Senate Finance Committee's majority staff published a secret shopper study. Be precise about what it measured, because it gets misquoted all the time. It covered Medicare Advantage plans, not Medicaid: 12 plans in six states, 10 mental health providers per plan, 120 calls in total, with staff calling on behalf of an older adult family member with depression.

• 39 of the 120 calls (33%) reached non-working numbers, incorrect numbers or calls that were never returned.
• Staff got a possible appointment in 22 of 120 calls (18%). That count includes six calls routed to a third-party matching service. Without them it was 16 of 120 (13%).
• Appointment rates ranged from 0% in Oregon to 50% in Colorado.
• The headline finding: more than 80% of listed in-network mental health providers were "ghosts," meaning unreachable, not accepting new patients or not in network.

One more precision point. The study did not test whether an appointment was available within a set number of days. Success meant getting a possible appointment at all.

None of this was new to anyone who had read CMS's own work. In the third round of its MA online directory reviews (November 2017 to July 2018), CMS found that 48.74% of 10,504 provider locations had at least one inaccuracy.

HHS-OIG has since measured the problem from a different angle. Its October 2025 report (OEI-02-23-00540) looked at 40 MA plans and 20 Medicaid managed care plans across 10 counties and matched directories against claims. On average, 55% of the behavioral health providers listed by MA plans, and 28% of those listed by Medicaid plans, furnished no services to the plan's enrollees in 2023. Of the sampled inactive providers, OIG found that 72% should not have been listed at all and 46% worked at none of the locations the directory showed.

Then June 2026 brought two OIG reports on maternal health in Medicaid managed care, covering plans from three large national companies in Louisiana, Missouri, Nevada, New Jersey and Washington. The directory report (OEI-05-24-00090) found that 9% of listed maternal health providers said they were not in network, 22% of in-network providers were missing from the directory, 33% had at least one inaccurate phone number and/or address, and 21% did not work at one or more listed locations. The companion report (OEI-05-24-00091) examined the network lists the same plans send to states for adequacy oversight. 24% of providers on those lists said they were not in network, over one-quarter had no accurate phone number, and 46% of the providers on the network lists did not appear in the plan's own online directory. CMS concurred with both reports.

Read that last number again. The plan's adequacy list and its public directory disagreed on nearly half the providers. That is not a calling problem. It is two systems of record.

The rules, by line of business

Here is what applies to whom, and from when.

Line of business	Rule	The clock	Applies from
Medicare Advantage	42 CFR 422.111(m)	Update within 30 days of learning of a change; attest at least annually	Plan years on or after January 1, 2026
Medicare Advantage	42 CFR 422.120 (Provider Directory API)	Update no later than 30 calendar days after receiving new information	January 1, 2021
Medicare Advantage	CAA 2026 section 6220 (REAL Health Providers Act)	Verify every 90 days; remove departed providers within 5 business days; report an accuracy score	Plan year 2028; scores public from 2029
Medicaid managed care	42 CFR 438.10(h)(3)	Electronic directory updated no later than 30 calendar days after receiving updated information	In force now
Medicaid managed care	42 CFR 438.68(f)(1) secret shopper	Errors reach the state within 3 business days and the plan within 3 more; plan corrects on the 438.10(h)(3) timeline	Rating periods on or after July 9, 2028 (a CMS chart lists July 10)
Commercial and Exchange	No Surprises Act, PHSA 2799A-5	Verify every 90 days; update within 2 business days of receiving provider information	Plan years on or after January 1, 2022

Medicare Advantage: your directory now goes to CMS

The biggest change for MA plans is 42 CFR 422.111(m), "Increasing consumer transparency," finalized in September 2025 (90 FR 45140) and applicable to plan years beginning on or after January 1, 2026. MA organizations must:

1. make their directory information available to CMS for publication online;
2. submit it in the format, manner and timing CMS sets;
3. update it within 30 days of becoming aware of a change; and
4. attest at least annually that what they submitted is accurate.

In practice, your directory now sits inside Medicare Plan Finder next to every competitor's. According to CMS's September 2026 office hours Q&A, September 18, 2026 was the target for production data and the HPMS attestation deadline, and the data goes live on the CY2027 Plan Finder on October 1, 2026. CMS ingests and validates files daily. Errors come in three tiers, and a Level 2 "Record Skip" suppresses that record on Plan Finder, so a formatting mistake can hide a contracted provider from people choosing a plan. CMS has said the CY2027 attestation reflects "reasonable, good-faith efforts" and does not require error-free data. We would not plan on that tolerance lasting. The full move to FHIR-based JSON is slated for CY2028 at the earliest.

Two older rules still apply. The Provider Directory API under 42 CFR 422.120, in place since January 1, 2021, must be updated no later than 30 calendar days after the plan receives new information. And 422.111(e) requires enrollee notice of a provider termination 45 calendar days ahead for primary care and behavioral health providers and 30 days for other specialties, which only works if someone tells provider data the termination is coming.

Here is the detail most teams skimmed past. CMS proposed making plans attest that directory data was consistent with the data they submit for network adequacy, then declined to finalize it, choosing "to distinguish provider directory accuracy from network adequacy." Some teams read that as permission to keep two lists. We read it the other way. OIG just showed what two lists look like in Medicaid, and nobody reviewing your HSD tables next to your Plan Finder data will need a regulation to draw a conclusion. Keep one list. We explain why the internal list and the CMS view drift apart in why your network passes internally and fails CMS.

The REAL Health Providers Act: 90 days, 5 business days, a public score

Section 6220 of the Consolidated Appropriations Act, 2026, the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, signed in February 2026, writes the MA directory into statute starting with plan year 2028. The enrolled text requires network-based MA plans to:

• verify each listed provider's directory information at least once every 90 days (hospitals and other facilities the Secretary designates can be verified less often, but at least every 12 months);
• flag any provider the plan could not verify as possibly out of date;
• remove a provider within 5 business days of determining the provider has left the network; and
• hold members to in-network cost sharing when they relied on a listing that was in the directory on the date the appointment was made.

The accountability piece is the one to plan around. Starting with plan years beginning on or after January 1, 2028, each plan must run an annual accuracy analysis on a random sample of its directory, including samples of specialties with high inaccuracy rates (the statute names mental health and substance use disorder as one possible example), and report an accuracy score to CMS. For plan years beginning on or after January 1, 2029, CMS posts the scores in a machine-readable file, and plans must list their score prominently on their own directory.

A public score changes the incentive.

Note where the removal clock starts: when the plan determines the provider has left. In our experience the determination is the slow part. The removal itself takes minutes.

Medicaid and commercial: rules already in force

Medicaid managed care plans have lived with a 30-day rule for years. Under 42 CFR 438.10(h)(3), electronic directories must be updated no later than 30 calendar days after the plan receives updated information, and paper directories monthly (quarterly if the plan has a mobile-enabled electronic directory). Required elements include name and group affiliation, street address, phone, website, specialty, whether the provider accepts new enrollees, cultural and linguistic capabilities including ASL, physical accessibility and, since July 1, 2025, whether the provider offers covered services by telehealth. Directories must be posted in a machine-readable file. Section 5123 of the Consolidated Appropriations Act, 2023 added a statutory floor of quarterly updates for managed care directories from July 1, 2025, but the 30-day regulation is stricter and still controls.

The new pressure is the 2024 Access Rule's secret shopper provision, 42 CFR 438.68(f). An independent entity hired by the state will test each plan's directory for active network status, street address, phone number and whether the provider accepts new enrollees, across primary care, OB/GYN, outpatient mental health and SUD, and one state-selected provider type. Errors go to the state within 3 business days and to the plan within 3 business days after that, and the plan must correct them on the 438.10(h)(3) timeline. We cover the wait-time half of that survey in our piece on 438.68(e) and the secret shopper.

Commercial and Exchange plans answer to the No Surprises Act (42 U.S.C. 300gg-115), effective for plan years beginning on or after January 1, 2022. It applies to group health plans and to issuers of group and individual coverage, not to MA or Medicaid. Plans must verify directory information at least once every 90 days, update the database within 2 business days of receiving information from a provider, answer network-status questions within 1 business day in writing (and keep the record for 2 years), and have a procedure for removing providers they cannot verify. The statute leaves the removal period to the plan, so "removed after 90 days" is not a federal rule. A member who relied on a wrong listing cannot be charged more than in-network cost sharing.

Enforcement has been softer than the text. In FAQs Part 49 (August 20, 2021), the Departments said rulemaking would not come until after January 1, 2022, that plans should use a good-faith, reasonable interpretation of the statute until then, and that they would not deem a plan out of compliance with the directory requirements if it honored the cost-sharing protection. Check whether implementing rules have issued before you treat that posture as current. The section does not preempt state directory laws, so your state may ask for more.

Where directory errors are born

Every rule above measures the directory. None of them cares how the error got there. You should, because nearly every bad listing we have traced started in one of three places.

Roster intake

Delegated groups and health systems send rosters as spreadsheets, each in its own layout, on their own schedule. Someone maps the columns, someone else loads them, and a field that meant "billing address" in the group's system becomes "practice location" in yours. A provider who left the group in March stays on the roster because the group only ever adds rows. Most plans validate a roster for format (is the NPI ten digits, is the ZIP real) and very few validate it for meaning (is this person still here, and does this location see patients). OIG's finding that 46% of sampled inactive behavioral health providers worked at no listed location is what that gap looks like at scale.

Terminations

Terminations are the slowest-moving data in a plan. A provider retires, a group closes a site, a contract lapses, and the news reaches contracting weeks before it reaches provider data, if it arrives at all.

Location versus billing address

The classic. A group bills from a central business office and its providers see patients at six clinics. If intake takes the address from the claim or the W-9, the directory sends members to an office with no exam rooms. CMS's December 2024 network adequacy guidance says providers must be listed at the office where they see patients for consultations, not where they only perform procedures, and that names and addresses must be submitted identically each time. The REAL Health Providers Act describes directory addresses as the "primary office or facility addresses where items or services are furnished." The rules agree. The service location is the directory address. The billing address is a payment field.

A checklist to stop errors at the source

1. Collect service locations separately from billing. Make practice location a required, distinct field at onboarding, with the days the provider actually sees patients there, and never backfill it from claims or the W-9.
2. Validate rosters for meaning, not only format. Compare every incoming roster to the last one. New names, dropped names and changed addresses each get a human look before loading.
3. Make a termination an event, not an edit. Contracting, credentialing and provider relations feed one termination intake with an effective date, so the 422.111(e) notice clock and the directory removal start from the same record.
4. Stamp every field with a verified date and a source. The 90-day rules (commercial today, MA from 2028) apply provider by provider. You cannot prove a 90-day cycle you did not record.
5. Ask about new patients at every touch. Accepting new patients is a secret shopper element in Medicaid and a directory element everywhere. Capture it in recruiting, contracting and credentialing, not only in an annual survey.
6. Run one provider list. The HSD table, the state network file, the Plan Finder feed, the API and the website should all read from the same records. If they can disagree, eventually they will.
7. Test yourself like a shopper. Call a random sample of your own listings every quarter, oversampling behavioral health, the way the MA accuracy analysis will from 2028.
8. Treat a Plan Finder record skip as an outage. It hides a contracted provider from members choosing a plan. Someone should own the daily error file.

Calling campaigns clean the directory after members have already been sent to the wrong door. Intake discipline keeps the error from existing. With a 90-day clock, a 5-business-day removal rule and a public accuracy score on the way, the plans that do well will be the ones whose directory is a byproduct of how they build the network rather than a separate project somebody refreshes every quarter. Our checklist for what to collect when onboarding a provider is where that starts.

Blueprint keeps recruiting, onboarding and credentialing status on the same provider record, so the location a provider confirmed when they signed is the one your team works from. You can see the adequacy side on sample data at the network map, or start with the free build scorecard.