The Provider Directory Is Becoming a Public Quality Measure

Why Medicare Advantage's new accuracy grades could expose a much larger healthcare data problem

A physician has a valid National Provider Identifier. Their specialty is correctly classified. Their practice address exists. Your health plan lists them as in-network. But when a patient calls, the physician does not accept the insurance, no longer practices at that location, or has not accepted new patients in months.

Your directory says access exists. The patient discovers it does not.

For years, healthcare organizations have treated provider-directory inaccuracies as an administrative nuisance: outdated spreadsheets, conflicting provider rosters, disconnected credentialing systems, and periodic cleanup exercises. That interpretation is becoming obsolete.

Under the REAL Health Providers Act, enacted as part of the Consolidated Appropriations Act of 2026, Medicare Advantage provider-directory accuracy is moving toward public accountability. CMS's October 16, 2026 proposed rule, CMS-4214-P, outlines routine verification, annual scoring, public reporting, and financial protections for beneficiaries relying on incorrect listings. [1] [2]

Provider-directory data is becoming a measurable representation of operational integrity. At Brandywine Consulting Partners (BCP), our experience integrating CMS NPPES information into healthcare analytics and medicinal drug-discovery initiatives reinforces a core principle: an identifier is valuable only when its associated locations, specialties, relationships, effective dates, and evidence are trustworthy.

• ▸Directory accuracy is going public. CMS-4214-P proposes 90-day verification, annual accuracy analyses, and public machine-readable grades for Medicare Advantage directories.
• ▸A grade can conceal access failures. Under the proposed weights, a plan with only 80% network-participation accuracy could still score 92% — an A.
• ▸An NPI proves identity, not availability. Participation, location, service, and contract relationships each need their own evidence and effective dates.
• ▸History becomes a liability test. Plans may need to reproduce what the directory displayed on the day a member scheduled care.
• ▸AI should surface uncertainty. Models can prioritize review; they should not convert inferences into published facts.

Section 6220 of the Consolidated Appropriations Act of 2026 established new Medicare Advantage provider-directory obligations. CMS proposed the detailed implementation framework in October 2026; proposals remain subject to final rulemaking. [1] [2]

The distinction is significant: CMS is not simply requesting better records. It is creating a mechanism for directory accuracy to become visible and comparable. This is distinct from HEDIS and Medicare Advantage Star Ratings, but the reputational and operational implications are substantial.

Financial exposure changes the engineering requirements

For qualifying otherwise-covered services, the statute and proposed rule would protect certain beneficiaries who scheduled care relying on an incorrect in-network listing. The applicable cost-sharing protection makes historical reconstruction important. [2] A plan must be able to show what its directory displayed when the appointment was scheduled — not simply what the directory says now.

CMS's proposed weighted accuracy methodology allocates 40% to network participation, 20% each to contact information and address, 10% to specialty, 3.5% each to accessibility accommodations and telehealth, and 3% to acceptance of new patients. [2]

Under the proposal, scores from 90% through 100% receive an A. Consider a hypothetical plan with only 80% network-participation accuracy and perfect performance on every other attribute: (80% × 40%) + (100% × 60%) = 92%, still an A. Similarly, 50% accuracy for the new-patient-acceptance field and 100% for everything else produces a 98.5% composite.

BCP's interpretation: a regulatory composite score is not the patient's probability of successfully obtaining care. Plans should measure both statutory score compliance and actual operational access — verified participation, successful contact, appointment availability, and service at the represented location.

The National Plan and Provider Enumeration System (NPPES) provides a foundational identity reference: individual and organizational NPIs, provider names, taxonomy information, addresses, and certain practice-location and electronic endpoint details. A Type 1 NPI identifies an individual; a Type 2 NPI identifies an organizational provider. CMS cautions that an NPI does not validate professional licensure or credentialing. [4] [5] [13]

An NPI alone cannot prove present network participation, appointment availability, active service at a location, or willingness to accept new patients. A clinician may practice in multiple locations, with different contracts, schedules, and service configurations. A flat "NPI → Name → Address → Specialty" directory loses that complexity.

The more accurate relationship is Practitioner → Organization → Location → Service → Plan → Network → Contract → Effective Period. Each edge requires evidence, effective dates, and an authoritative source.

Upstream schema drift is an operational risk

Effective March 3, 2026, CMS discontinued Version 1 NPPES monthly and weekly files. Version 2 supports expanded character lengths for fields including provider first names and legal business names; CMS also publishes deactivation and supplementary files. [4] Older database schemas and parsers can truncate names, break identity matching, or create false duplicates. Continuous schema validation and source version control are therefore necessary parts of the directory-control environment.

CMS's proposed rule cites HHS OIG findings concerning inactive behavioral-health providers in managed-care directories: on average, about 55% of listed providers furnished no services to plan enrollees in 2023, and 72% of surveyed inactive providers should not have been listed. Inactivity alone does not prove unavailability, but it is a strong investigation signal when combined with other evidence. [2] [7]

CMS also reported that 44.29% of 18,852 reviewed provider-location listings in its 2022–2024 reviews contained at least one inaccuracy. This describes sampled reviews, not necessarily all directory listings nationally. [2]

The downstream impact extends to network adequacy, referrals, care management, claims attribution, access analytics, and AI-powered navigation. An AI agent can produce a technically valid recommendation that is operationally wrong because the directory relationship behind it is stale. A correct algorithm using an incorrect relationship still produces an incorrect decision.

BCP has applied CMS NPPES information in healthcare and medicinal drug-discovery work to support provider identity, specialty normalization, and geographically informed analytics. The analytical benefit comes from combining provider identity with additional governed and independently corroborated datasets — not treating NPPES as a standalone statement of availability or research suitability.

Healthcare analytics

Normalized provider identities support claims attribution, referral-network analysis, utilization metrics, population-health analytics, and provider-performance reporting. Rendering, billing, referring, and organizational identifiers can refer to different participants in the same encounter. A canonical identity and relationship layer helps prevent duplicate activity counts, incorrect attribution, and inconsistent BI measures. See how BCP approaches this in Analytics & Reporting.

Pharmaceutical research and clinical-study feasibility

For drug discovery and clinical development, NPPES offers a reference universe for clinicians, specialties, practices, and geography. A study-site feasibility program may combine NPPES with registered study information in ClinicalTrials.gov, NIH-funded research data, CMS Open Payments, Medicare utilization data, and appropriately licensed clinical or commercial sources. [9] [10] [11] [12]

The challenge is entity resolution. Investigator names, institutional affiliations, addresses, and identifiers do not necessarily align. A matching name and specialty do not prove identity; a disclosed financial relationship does not prove investigator suitability. BCP's approach is to maintain explicit match confidence, source lineage, reviewer controls, and temporal relationships.

Use cases include therapeutic-area clinician discovery, geographic research-capacity mapping, investigator and institutional relationship analysis, and longitudinal research intelligence. These are decision-support capabilities; final site qualification still requires direct verification of facilities, qualifications, patient access, staffing, and protocol readiness.

BCP recommends a graph-informed, relational provider architecture in which stable identities are separated from changeable relationships. Five logical layers are especially useful:

1. ▸Identity — individual and organizational NPIs, aliases, taxonomy, enumeration status, and matching lineage.
2. ▸Relationships — practitioners, organizations, locations, services, and affiliations.
3. ▸Networks — payer, product, network, contract, effective dates, and location-specific participation.
4. ▸Evidence — verification method, source, timestamps, freshness, conflict status, and retained supporting records.
5. ▸Publication — versioned APIs and member-facing directory releases.

The HL7 Da Vinci PDex Plan-Net FHIR Implementation Guide provides useful structure through resources and profiles such as Practitioner, Organization, Location, HealthcareService, PractitionerRole, and OrganizationAffiliation. [8] These support much richer expression of provider-network relationships than one row per NPI. CMS's Provider Directory API requirements are distinct from the Provider Access API introduced under CMS-0057-F. [6] For the CMS-0057-F side of that picture, see January 1, 2027 Is Not a FHIR Deadline. It Is a Workflow Deadline.

CMS proposes retaining enough electronic provider-directory history for at least 10 years and providing relevant records within five business days upon request. [2] A database that overwrites prior values will struggle to reconstruct what was displayed to a patient on an earlier scheduling date.

A defensible design distinguishes valid time — when a fact or contract was effective — from transaction time — when the system learned or recorded the fact. It should also record publication time, when a change reached the member-facing directory.

Suppose a contract ended March 1, the plan learned on March 10, and the public directory was corrected March 13. All three dates matter. Historical queries must reproduce what was displayed on March 12 without pretending the March 13 correction had already occurred. Immutable publication versions, audit logs, and effective-dated relationships make that possible.

AI and machine learning can detect geographic anomalies, provider-location conflicts, unexplained relationship changes, stale verification records, and patterns of inactivity requiring review. They can prioritize outreach, classify submitted evidence, and identify reconciliation exceptions.

However, multiple websites repeating the same obsolete address are not independent verification. A model-inferred practice affiliation is not a confirmed network contract. BCP recommends separating observed verified facts, model inferences, unresolved conflicts, and approved published assertions. AI can accelerate discovery and review; authoritative verification must satisfy applicable regulatory methods before material assertions change. The same principle runs through AI Without Governance Is Just Risk at Machine Speed and The AI-Native EHR Has a Data Pollution Problem.

A sustainable program is a continuously operating control system rather than a recurring spreadsheet-cleanup project. BCP recommends five capabilities:

• ▸01 — Source intelligence: versioned NPPES ingestion, incremental updates, schema tests, deactivations, source manifests, and contracting/credentialing integration.
• ▸02 — Identity governance: canonical provider and relationship records, deduplication, taxonomy mapping, evidence hierarchy, and conflict-resolution procedures.
• ▸03 — Attribute-specific verification: regulatorily acceptable validation methods, refresh schedules, verifiable supporting evidence, and responsible exception owners.
• ▸04 — Independent quality metrics: regulatory accuracy scores plus access-focused KPIs including participation accuracy, verification aging, contact success, correction latency, and historical replay success.
• ▸05 — Secure publication and audit: governed FHIR APIs, release reconciliation, access-controlled administration, change approval, monitoring, and immutable logs.

A governed provider intelligence layer can improve network strategy, referral analysis, population-health workflows, claims and revenue-cycle controls, research intelligence, interoperable care coordination, and grounded AI applications. Rather than each team rebuilding its own interpretation of provider identity, a shared service can expose approved identities, relationships, evidence, and effective dates to multiple consumers.

The return on investment is not simply a cleaner directory. It is reducing redundant reconciliation, inconsistent provider truth, duplicated technical work, and decisions that rest on unverifiable relationships. A successful API response is not proof of a valid network relationship; a successful NPPES match is not proof of clinical accessibility.

BCP works across healthcare data engineering, NPPES provider-master modernization, HL7/FHIR interoperability and integration, payer and claims integration, analytics and BI, AI-assisted data quality, Azure cloud architecture, governance, and secure deployment. Our provider-data experience also supports medicinal drug-discovery intelligence through reliable clinician and institutional identity resolution.

A Provider Directory Integrity & NPPES Readiness Assessment can examine NPPES pipeline completeness, provider matching, contract and directory discrepancies, verification evidence, FHIR API structure, historical replay capability, CMS scoring readiness, and opportunities to reuse identity services for population health, analytics, and research.

BCP then helps develop a prioritized roadmap and implement the data models, controls, integrations, monitoring, and reporting needed for ongoing operations — not a one-time fix.

Most organizations can count the providers in their directory. Far fewer can demonstrate how many are genuinely accessible under the exact network, location, specialty, and contractual conditions published to members. Fewer still can reconstruct a historic patient-facing listing and show the precise evidence behind it.

The biggest provider-directory risk may not be the number of wrong records. It may be the organization's inability to establish what was true.

As provider-directory accuracy becomes more visible and consequential, healthcare organizations should manage provider data as a continuously changing network of identities, relationships, locations, services, evidence, and time. Those foundations support not only regulatory readiness, but more trustworthy healthcare analytics and AI.

Your provider directory should be an asset, not a liability.

Can your organization demonstrate that its NPPES data, network rosters, contracts, service locations, and published directory records tell the same story? Can you reconstruct and defend yesterday's published assertions?

BCP helps healthcare organizations assess provider data integrity, modernize NPPES integration, implement FHIR-enabled directories, improve data governance, and establish reliable analytical foundations for healthcare and medicinal drug discovery.

Request a Provider Directory Integrity & NPPES Readiness Assessment · Explore BCP services

contact@brandywine.consulting · 1-302-983-1115

• ▸The Gap Between CMS-0057-F Compliance and CMS-0057-F Readiness: why regulatory compliance and operational readiness are different questions.
• ▸The Prior Authorization Exception Tax Under CMS-0057-F: measure the manual repair hiding behind successful API transactions.
• ▸The AI-Native EHR Has a Data Pollution Problem: why AI amplifies upstream data quality failures.
• ▸AI Without Governance Is Just Risk at Machine Speed: build evidence, boundaries, and accountability into AI systems.

Sources reviewed November 5, 2026. Numbered citations support the associated factual claims. Scoring scenarios, architecture, and operating recommendations are BCP analysis. CMS-4214-P is a proposed implementing rule; proposed details are subject to final rulemaking.

• ▸[1] Centers for Medicare & Medicaid Services. Medicare Program; Implementation of Sections 6219, 6220, and 6224 of the Consolidated Appropriations Act, 2026 (CMS-4214-P). Fact sheet, October 2026. ↩1 ↩2
• ▸[2] Federal Register. CMS-4214-P Proposed Rule, 91 FR 66408–66489. October 20, 2026. Verification, scoring, retention, and beneficiary protections. ↩1 ↩2 ↩3 ↩4 ↩5 ↩6 ↩7
• ▸[3] Centers for Medicare & Medicaid Services. Medicare Plan Finder 2026 Updates. ↩
• ▸[4] Centers for Medicare & Medicaid Services. NPPES NPI Downloadable Files. Version 2 files, deactivations, and supplementary files. ↩1 ↩2
• ▸[5] Centers for Medicare & Medicaid Services. National Provider Identifier FAQs. ↩
• ▸[6] Centers for Medicare & Medicaid Services. Provider Directory API guidance. ↩
• ▸[7] HHS Office of Inspector General. Many Medicare Advantage and Medicaid Managed Care Plans Have Limited Behavioral Health Provider Networks and Inactive Providers. 2025. ↩
• ▸[8] HL7 Da Vinci. PDex Plan-Net Implementation Guide. ↩
• ▸[9] Centers for Medicare & Medicaid Services. Open Payments Data. ↩
• ▸[10] National Library of Medicine. ClinicalTrials.gov API. ↩
• ▸[11] National Institutes of Health. NIH RePORTER API. ↩
• ▸[12] Centers for Medicare & Medicaid Services. Medicare Physician & Other Practitioners — by Provider and Service. ↩
• ▸[13] Centers for Medicare & Medicaid Services. NPPES Data Dissemination. ↩