CMS Provider Directory Accuracy Attestation 2026: What It Means for Your Credentialing

What Is the CMS Provider Directory Accuracy Attestation Requirement for 2026?

As of September 2026, the CMS provider directory accuracy attestation requirement is live, and Medicare Advantage organizations must now have a CEO, CFO, or COO personally attest in the Health Plan Management System (HPMS) that their provider directory data is accurate, complete, and truthful. This requirement stems from CMS Final Rule CMS-4208-F2, finalized in September 2025, and is reinforced by the REAL Health Providers Act signed into law on February 3, 2026. CMS found that 48.74% of MA directory locations contain at least one inaccuracy, making this the most aggressive federal push for directory accuracy in Medicare history.

• What triggers the requirement: MA organizations must submit provider data to CMS in a standardized format, update it within 30 days of any change, and attest annually that the data is accurate.
• Why it matters for providers: Directory accuracy depends on credentialing data. If your CAQH profile, enrollment records, or payer panel status is outdated, the directory will reflect that error, and the payer now bears personal executive liability for it.
• What is coming next: The REAL Health Providers Act adds public directory accuracy scores starting plan year 2029 and 90-day verification cycles starting plan year 2028.

What Changed and Where It Came From

The provider directory accuracy problem has been building for years. CMS conducted a national review of Medicare Advantage online directories and found that nearly half of all provider locations listed contained at least one error. Wrong phone numbers, incorrect addresses, outdated specialty listings, and providers marked as accepting new patients when they were not. The healthcare industry already spends more than $2 billion annually maintaining provider data, and the error rate has not improved.

CMS responded with a two-part regulatory push. The first part is CMS Final Rule CMS-4208-F2, finalized on September 19, 2025, which requires MA organizations to submit provider directory data directly to CMS for publication on Medicare Plan Finder. The rule also mandates annual attestation of accuracy by a named executive, 30-day update windows when the organization learns of a data change, and a standardized data format for submissions. The second part is the REAL Health Providers Act, enacted as part of the Consolidated Appropriations Act of 2026 on February 3, 2026. Starting with plan year 2028, the Act requires 90-day provider data verification cycles, updated timelines for directory changes, annual accuracy analyses, and public accuracy scores displayed in MA directories and on a CMS website starting plan year 2029.

Who Is Affected by the Provider Directory Accuracy Rules?

The regulatory mandate falls directly on Medicare Advantage organizations. They are the ones submitting directory data, signing the attestation, and facing enforcement if the data is wrong. But the operational reality is that MA plans cannot fix directory accuracy without accurate data from providers. Every field in a directory listing originates from a provider’s credentialing file, enrollment record, or practice profile.

That means the compliance pressure flows downstream to every provider enrolled in an MA network. Practice managers, credentialing coordinators, and enrollment specialists will see increased verification requests from payers. CAQH attestation cycles will be scrutinized more closely. Payers will push harder for real-time updates when a provider changes locations, adds a specialty, or adjusts panel availability. In our experience matching providers with payer networks, the practices that keep their credentialing current are the ones that avoid the disruption. The ones that treat credentialing as a one-time event are the ones that lose network status or face claim denials when the directory data does not match the enrollment record.

How Does Credentialing Data Drive Directory Accuracy?

The connection between credentialing and directory accuracy is direct and mechanical. When a provider’s CAQH profile lists a practice address, that address feeds into the payer’s credentialing system. The credentialing system feeds the provider directory. If the CAQH profile has an outdated address, the directory lists the wrong address. If the credentialing file shows an expired license, the payer may mark the provider as inactive in the directory even though the provider renewed the license weeks ago.

The most common data fields that create directory errors are practice location addresses, phone numbers, specialty classifications, languages spoken, panel status (accepting new patients or not), and hospital affiliations. Each of these fields lives in the CAQH Provider Data Portal profile, and each must be re-attested at least every 120 days under current CAQH requirements. Providers who miss the CAQH re-attestation window risk having their profiles marked as incomplete, which triggers downstream errors in every payer directory that pulls from CAQH.

The No Surprises Act added another layer by requiring health plans to verify provider directory information at least every 90 days and update directories within 2 business days of learning about a change. That verification process starts with the credentialing file. If your file is not current, the verification flags an error, and the payer must either correct it or remove the listing.

What Should Providers Do Now to Stay Compliant?

Payers are going to push harder on data accuracy because their executives are now personally on the line. Providers who get ahead of this will avoid the disruption. Here is what to prioritize:

1. Audit your CAQH Provider Data Portal profile immediately. Confirm that every practice location, phone number, specialty, and panel status is current. If you have recently moved, added a location, or changed your accepting-new-patients status, update the profile before the next payer verification cycle hits.
2. Complete your CAQH re-attestation on time. The 120-day attestation cycle is not optional. A missed attestation marks your profile as incomplete, and payers will flag your directory listing as unverified.
3. Verify your PECOS and Medicare enrollment records match your CAQH data. CMS cross-references enrollment records with directory data. If your PECOS address says Suite 200 and your CAQH profile says Suite 210, that is an error.
4. Respond promptly to payer verification outreach. When a payer contacts you to verify your directory information, treat it as a compliance deadline, not a routine inquiry. Delayed responses can result in your listing being removed or marked as unverified.
5. Designate one person in your practice to own credentialing data updates. Directory accuracy falls apart when updates are handled ad hoc. One point of contact who monitors CAQH, PECOS, and payer portals reduces the risk of data drift across systems.

Common Credentialing Gaps That Cause Directory Errors

Providers often assume that once they are credentialed and enrolled, the directory will take care of itself. It does not. Directory data degrades over time as practice information changes and credentialing records are not updated to match. The most common gaps we see across the practices we work with include the following.

Stale practice addresses are the leading cause of directory inaccuracy, according to the CMS national review. A provider moves to a new suite or a second location opens, but the CAQH profile and PECOS records still show the old address. The payer pulls the old address into the directory, and patients show up at the wrong location.

Lapsed CAQH attestations are the second most common issue. When a provider misses the 120-day re-attestation window, CAQH marks the profile incomplete. Some payers treat an incomplete profile as grounds to suspend the provider’s directory listing, which can look like a network termination to patients searching for in-network care.

Outdated specialty listings create a subtler problem. A provider may be credentialed as internal medicine but practicing primarily as a hospitalist. The directory lists them as accepting outpatient internal medicine patients, driving calls and referrals they cannot serve. Similarly, providers who add a subspecialty but do not update their credentialing file miss directory exposure in that specialty.

Disconnected systems compound all of these. CAQH, PECOS, state Medicaid portals, and individual payer credentialing portals do not sync automatically. A change made in PECOS does not propagate to CAQH, and a CAQH update does not push to the payer. Each system must be updated independently, and each has its own timeline and format requirements.

Key Data Fields That Drive Directory Errors

Managing Credentialing In-House vs. Outsourcing

For a solo provider or a small practice with one or two payers, maintaining credentialing data in-house is manageable. The workload scales steeply with the number of providers and payers. A group practice with 5 providers enrolled across 10 payers has 50 credentialing relationships to maintain, each with its own attestation timeline, verification cycle, and data format. Layer in CAQH, PECOS, and state Medicaid portals, and the total number of records that need regular attention can reach into the hundreds.

Outsourcing credentialing maintenance to a team that tracks these timelines across systems is the approach most mid-size and growing practices use to stay ahead of directory accuracy requirements. The cost of a missed attestation or a directory error is not just administrative. It can mean removed directory listings, patient complaints, CMS audit flags, and in the worst case, network termination that takes months to reverse. Across the billing companies and practices we vet, a recurring pattern is that credentialing lapses that seem minor at the time compound into enrollment interruptions that halt revenue for weeks.

CMS Provider Directory Attestation Timeline

Frequently Asked Questions

Next Steps

Start with a full audit of your CAQH Provider Data Portal profile and your PECOS enrollment records. Compare every field against your current practice information and update anything that has changed.

If you manage credentialing for multiple providers or across multiple payers, read our guide on CAQH attestation for a walkthrough of the re-attestation process and common mistakes to avoid.

For practices that need help maintaining credentialing data across CAQH, PECOS, Medicaid portals, and payer systems, our credentialing services team handles the ongoing updates so you do not have to track every cycle yourself.