Key Points

• The Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, enacted Feb. 3, 2026, as part of the Consolidated Appropriations Act, 2026 (CAA), turns Medicare Advantage (MA) provider directory accuracy into a measured, publicly graded obligation beginning in contract year 2028.
• CMS’s proposed rule (CMS-4214-P) would require MA plans to verify most directory listings every 90 days (every 12 months for acute inpatient hospitals, intensive care units and surgical facilities), score directory accuracy annually on a weighted, letter-grade scale, and add two new terms to every network provider contract.
• Beginning in 2029, plan-level letter grades must appear in each plan’s directory and will be published by CMS, creating a new, comparable data point for regulators, enrollees, brokers, buyers and lenders.
• Comments on the proposed rule are due Dec. 15, 2026.

The Centers for Medicare & Medicaid Services (CMS) has issued a proposed rule to implement the REAL Health Providers Act, which was published in the Federal Register on Oct. 20, 2026 (2026-21420; 91 FR 66408). This alert focuses on the new provider directory requirements and what they mean for MA organizations and those investing in them.

What is the REAL Health Providers Act?

The REAL Health Providers Act, Section 6220 of the CAA, establishes provider directory accuracy and accountability requirements for MA organizations beginning in contract year 2028. Its target is so-called “ghost networks” — directories listing providers who have left the network, moved, or are not accepting new patients. In CMS reviews conducted between June 2022 and June 2024, 44.29% of MA directory location listings contained at least one inaccuracy.

What must Medicare Advantage plans do?

Under the statute and the proposed rule, MA organizations offering network-based plans must:

• Maintain an accurate online directory that includes, among other things, each provider’s specialty, address, contact information, whether the provider is accepting new patients, telehealth capabilities, accommodations for people with disabilities and — a CMS addition not found in the statute — any common ownership or control relationship between the plan and the provider.
• Verify each listing at least once every 90 days using CMS-specified methods (such as provider outreach or attestations, claims data and CMS data sources like NPPES). Only acute inpatient hospitals, intensive care units and surgical facilities would move to a 12-month cycle; practitioners listed at those facilities stay on 90 days. CMS also intends to rescind its NPPES enforcement discretion, so a matching NPPES record would no longer excuse a directory error.
• Flag any listing that cannot be verified with an indicator that the provider’s information may not be up to date.
• Remove a provider within 5 business days of determining that the provider has left the network and make other directory updates within 30 days.
• Conduct an annual random-sample accuracy analysis — with 35% of the sample drawn from mental health and substance use disorder providers — and report a weighted accuracy score to CMS by the first Monday in April following each contract year.
• Maintain daily archives of the online directory for at least 10 years and produce records to CMS within 5 business days of a request.

How will accuracy be scored?

CMS proposes a weighted score using the following calculation: network participation (40%), contact information and address (20% each), specialty (10%), disability accommodations and telehealth capabilities (3.5% each), and whether the provider is accepting new patients (3%). The composite converts to a letter grade (90% or above is an “A,” 49% or below is an “F”). For scoring purposes, internal plan data and claims could confirm only network status and specialty, and NPPES could not be used at all — meaning a good grade will depend on direct provider outreach and attestations. CMS is also weighing third-party certification of each plan’s analysis.

What protections do enrollees get?

If an enrollee receives otherwise covered care from a provider listed as in-network on the date the appointment was made, and the provider turns out to be out-of-network, the enrollee owes no more than the in-network cost-sharing amount. The burden sits squarely with the plan: If it cannot document the appointment date or confirm its archived directory in time, the protection applies by default. Notably, the proposed rule does not appear to address how the plan and the out-of-network provider settle payment when this protection applies.

What changes in provider contracts?

CMS proposes to require two new terms in every provider contract for a network-based MA plan: (1) obligating the provider to maintain current and accurate directory information, and (2) requiring the provider to document the earliest date an enrollee’s appointment was made. Plans will need to amend network agreements well before 2028, and the appointment-date term must survive termination, so former network providers remain obligated to produce scheduling records for at least 10 years. Because the cost-sharing protection applies in the enrollee’s favor when the plan cannot obtain that documentation, plans bear the risk of an unresponsive former provider and should consider building enforcement mechanics into the term itself.

What does this mean for transactions?

Directory compliance has historically been a back-office function that rarely surfaced in diligence. That is likely to change.

Public scores become a diligence and valuation data point. Starting in 2029, buyers and lenders will be able to compare plans’ letter grades side by side, and a poor grade may affect enrollment, reputation and regulatory scrutiny.

Diligence should begin before scores are public. For MA plan targets, buyers should request internal accuracy analyses, verification logs, directory archives, CMS audit findings, verification-vendor contracts and readiness plans for 2028.

Cost-sharing protection creates contingent exposure. Because the plan absorbs the cost-sharing difference, bears the burden of proof and loses by default when records are missing, buyers should evaluate historical error rates and archiving capability as potential sources of unbudgeted liability.

Purchase agreements should address directory compliance directly, through targeted representations, pre-closing covenants and, where appropriate, special indemnities.

Action items

• MA plans: Conduct a gap assessment against the 90-day and 12-month verification cycles, build or confirm a daily directory archive, model your likely letter grade, and prepare the two required provider contract amendments.
• Buyers, investors and lenders: Add directory accuracy, verification processes and cost-sharing exposure to diligence request lists and transaction documents.
• All stakeholders: Consider submitting comments by 5:00 p.m. Eastern on Dec. 15, 2026, particularly on scoring-method limits, third-party certification and provider payment settlement.

For more information, please contact Jared Ripp at jripp@foxrothschild.com if you have questions about how the REAL Health Providers Act applies to your organization, need assistance preparing comments or network contracts, or are evaluating directory compliance in connection with a transaction.

This information is intended to inform firm clients and friends about legal developments, including the decisions of courts and administrative bodies. Nothing in this alert should be construed as legal advice or a legal opinion. Readers should not act upon the information contained in this alert without seeking the advice of legal counsel. Views expressed are those of the authors and not necessarily this law firm or its clients.