If your center contracts with Medicare Advantage plans, expect more verification requests and less tolerance for stale data. If it does not, the lesson still applies: the fields CMS wants verified are the same fields families, Google, and AI assistants use to decide whether to call you.
What CMS proposed on October 20
The rule implements Section 6220 of the Consolidated Appropriations Act, 2026, known as the REAL Health Providers Act. It adds a new section, 42 CFR 422.123, that governs how Medicare Advantage plans build and maintain their provider directories (Federal Register, October 20, 2026). The plain-language version:
| Requirement | What CMS proposed |
|---|---|
| Verification cycle | Listings checked at least once every 90 days (every 12 months for acute inpatient hospitals, critical care and surgical services) |
| Unverifiable listings | Flagged with language such as "The provider's information may not be up to date." |
| Departed providers | Removed within 5 business days |
| Other updates | Generally within 30 days |
| Required fields | Name, specialty, phone, primary address, accepting new patients, disability accommodations, cultural and linguistic capabilities, telehealth capabilities, common ownership disclosure |
| Provider contracts | Plans must require contracted providers to keep their information current and accurate |
| Accuracy grade | Annual random-sample analysis starting with 2028 plan years, scored as a letter grade, with scores displayed publicly starting contract year 2029 |
Verification methods CMS lists include phone calls, email, provider attestation, claims data, internal plan information, and CMS-maintained data sources such as NPPES and the National Provider Directory, which CMS is still building. Translation for operators: someone is going to ask your team to confirm your details on a schedule, and the answer will be checked against other systems.
Why behavioral health got singled out
CMS built the rule on findings from the HHS Office of Inspector General. In report OEI-02-23-00540, OIG found that on average 55 percent of behavioral health providers listed in Medicare Advantage networks did not provide a single service to plan enrollees (Behavioral Health Business). Across the Medicare Advantage and Medicaid managed care plans it reviewed, 72 percent of the inactive providers should not have been listed as network providers at all. CMS's own 2022 to 2024 directory reviews found at least one inaccuracy in 44.29 percent of location listings.
of behavioral health providers listed in Medicare Advantage networks served no plan enrollees.
of inactive providers in the plans OIG reviewed should not have been listed at all.
of location listings in CMS's 2022 to 2024 reviews had at least one inaccuracy.
CMS proposes to treat mental health and substance use disorder treatment as a high-inaccuracy specialty, so those listings would fill the 35 percent of each plan's annual accuracy sample reserved for high-inaccuracy specialties. That is what a ghost network looks like from the inside. From the outside, it looks like a daughter on her lunch break, working down five numbers from a plan directory and reaching two disconnected lines, one voicemail, and one practice that stopped taking the plan last spring.
"Every family that reaches a ghost listing is a family that almost didn't call anyone. When the number on a plan directory rings to a closed office, nobody blames the plan. They give up for the day. Accurate listings are not paperwork. They are the first step of admissions."Christian Tanner, Owner, Nava Media
Why this matters even if you don't bill Medicare
Plenty of residential and detox programs never touch Medicare Advantage. Three reasons to pay attention anyway:
- Commercial plans already run on 90 days. Under the No Surprises Act, group and individual health plans must verify their directory information every 90 days, and providers must tell plans about material changes in a timely manner. The new rule brings Medicare Advantage in line and adds a public grade. Enforcement attention tends to travel.
- The data fields are the same everywhere. Address, phone, accepting new patients, telehealth, accessibility, languages. Those are the facts a payer directory, your Google Business Profile, your website, and your structured data all publish about you.
- Machines reward consistency. When three sources agree on where you are and what you offer, you are a safe answer to recommend. When they disagree, you are a risk. We covered how that plays out in how AI engines choose which rehabs to recommend, and why aggregators win when your data is weak in why directories outrank your rehab in AI answers.
"The data CMS wants verified is the same data Google and the AI assistants lean on when they decide whether to name you. If your payer directory, your Google Business Profile, and your website disagree about your phone number or whether you take new patients, you are teaching every system that your information can't be trusted."Christian Tanner, Owner, Nava Media
The directory readiness playbook
- NPPES record
- Payer directories
- Google Business Profile
- Website and schema
- What AI assistants repeat
None of this requires waiting for the final rule. Every step below also tightens your local search and AI visibility today.
- Build one master record. A single document per location with legal name, DBA, NPI, address, main and admissions phone numbers, levels of care, accepting status by level, telehealth availability, accessibility features, and languages spoken. Every other listing gets copied from it, never typed from memory.
- Name an owner. Verification requests land in inboxes nobody watches. Assign one person, usually in admissions or utilization review, to answer every plan attestation within the window and to log the date.
- Clean up NPPES. CMS names NPPES as a verification source. If your practice location or phone in NPPES is out of date, plans checking against it will flag you. Updating it takes minutes.
- Make "accepting new patients" honest by level of care. A center that is full in residential but open in IOP should say so. A blanket "yes" that sends a caller to a waitlist burns trust with the family and the plan.
- Match your public footprint to your directory record. Google Business Profile, your location pages, and your LocalBusiness or MedicalOrganization schema should carry the exact same name, address, phone, and hours. Inconsistent tracking numbers are the most common culprit we see. This entity work sits at the center of our SEO and AI search service.
- Audit quarterly, on the same cycle the plans use. Put a recurring 90-day review on the calendar. Call your own listed numbers. Search your center the way a family would. Fix what you find before a plan's sample finds it.
If calls are arriving but not converting, directory drift is often part of the reason. See why the phone rings all day but the payer mix is wrong and why calls keep coming but admits don't.
The timeline, and your chance to weigh in
- Oct 20, 2026Proposed rule published
- Dec 15, 2026Comments due, 5 p.m. Eastern
- Oct 1, 2027CY2028 marketing rules apply
- Jan 1, 2028Directory rules and accuracy analysis begin
- CY2029Accuracy grades go public
This is a proposed rule. Comments are due by 5 p.m. Eastern on December 15, 2026, on regulations.gov under docket CMS-2026-2533. Directory requirements would apply starting January 1, 2028, with public accuracy grades following for contract year 2029. Dates and details can change in the final rule.
"If you run a Medicare Advantage contracted program, read the docket and comment before December 15. Operators who field verification calls every quarter know exactly where the friction is. CMS should hear it from them, not only from the plans."Christian Tanner, Owner, Nava Media