Most deficiency notice responses fail on process, not intent — here are the five mistakes that turn a solvable problem into an enrollment freeze.
The Notice Arrives. Most Plans Are Already Behind.
A CMS deficiency notice is not a surprise. The data that triggers it — access gaps in a specific specialty or county, time-and-distance failures, insufficient provider-to-member ratios — was sitting in your network for months before CMS identified it. The notice is CMS telling you what you should have caught yourself.
Plans that respond well to deficiency notices have one thing in common: they treat the notice as a documentation and execution problem, not a crisis. Plans that respond poorly treat it as an emergency — and emergencies make people cut corners. Here are the five mistakes we see most often, and what a competent response actually looks like.
Mistake 1: Scrambling for Providers With No Paper Trail
The most common reaction to a deficiency notice is to immediately call every provider in the gap county and try to sign contracts in the next two weeks. The problem is not the urgency — urgency is correct. The problem is doing this with no documentation of the outreach.
CMS does not just want a signed contract. CMS wants evidence of a good faith effort to recruit — dates of contact, names of individuals contacted, method of outreach, and the provider's response. If you scrambled to sign three providers in 10 days with no documented recruitment trail before the notice arrived, your good faith case is weak regardless of how many contracts you produce.
The fix is not complicated: log every recruitment contact in a system of record, from the first outreach through execution. If you're doing this after the notice arrives, start immediately and log everything from that point forward. Retroactive documentation of prior outreach — if it happened — is legitimate; fabricated records are not.
Mistake 2: Submitting Uncredentialed Providers
A signed contract does not make a provider network-compliant. The provider must be credentialed with your plan before CMS will count them toward adequacy. This is the mistake that most frequently causes plans to miss the 30-day response deadline: they submit a response showing five new contracts in the gap county, CMS reviews the credentialing status, and three of the five providers are still in process.
Credentialing timelines run 60 to 120 days at most plans. If your deficiency notice response is due in 30 days, the only providers you can credibly count are those already in your credentialing pipeline — ideally within 30 days of completion. Any provider you're signing in response to the notice will not be credentialed in time.
This is why deficiency notice responses require a two-track strategy: present your newly executed contracts as evidence of good faith recruitment, and separately document what's in your credentialing pipeline. CMS distinguishes between immediate compliance and a credible remediation plan. Give them both.
Mistake 3: Thin Good Faith Effort Evidence
When you cannot close the gap in 30 days — and for rural or specialty gaps, you often cannot — the strength of your response depends almost entirely on your good faith effort documentation. Plans routinely submit this section with two or three provider contact logs and a vague statement about "ongoing recruitment efforts."
That is not sufficient. A strong good faith effort submission includes:
- A complete log of every provider contacted in the gap area over the prior 6 to 12 months, with dates and outcomes
- Documentation of any rate offers made and whether they were declined
- Evidence of outreach to provider groups, hospital systems, and FQHCs in the area
- Any third-party recruitment support engaged
- A forward-looking recruitment plan with specific milestones and timelines
CMS wants to see that you have been working this problem, that you know exactly what the market constraints are, and that you have a credible path to resolution. Thin documentation signals that the plan hasn't been tracking this gap at all — which is, frankly, the truth for most plans that receive deficiency notices.
Mistake 4: Missing the Deadline by Even One Day
The 30-day response window is not a soft deadline. Plans miss it for reasons that are entirely avoidable: the notice went to the wrong internal inbox, legal review took longer than expected, or the submission portal experienced technical issues on day 30.
Build a response process that accounts for these realities. The notice should trigger an immediate escalation to your network director, compliance lead, and legal counsel on day one. Your first draft response should be complete by day 21. Days 22 through 28 are for review, revision, and internal approval. Day 29 is your submission date. Day 30 is your emergency buffer.
If you are going to miss the deadline for any reason, contact your CMS account manager before the deadline, not after. Proactive communication about a delay — with an explanation and a revised timeline — is treated very differently than a late submission with no prior notice.
Mistake 5: Treating the Notice as a One-Time Event
The worst outcome of a deficiency notice is resolving it and then returning to the exact processes that created it. Plans that receive one notice are statistically more likely to receive a second one. The gap that triggered the notice was a symptom of a monitoring process that failed to catch what CMS caught.
After every deficiency notice response, run a process review: Why did we miss this gap? What would have caught it earlier? Is our monitoring cadence aligned with CMS's review cycle? Do we have real-time visibility into time-and-distance compliance, or are we running quarterly snapshots against an outdated provider directory?
A deficiency notice is not a failure of the compliance team. It is a signal that the plan's network monitoring is operating behind the regulatory clock. Closing that gap — between when the problem develops and when you see it — is the only durable fix. Everything else is crisis management.