Why Your Network Passes Internally and Fails CMS: 10 Gaps to Check

The short answer: the two reports aren't measuring the same network

A network passes internally and fails CMS because the two reports aren't measuring the same thing. CMS's Automated Criteria Check (ACC) in the Network Management Module places members using its MA Medicare Sample Census, which plans can't see. It reads your provider addresses exactly as typed on the HSD tables. And it applies counting rules most internal tools skip: specialty limits, telehealth exclusions, credit conditions, contract status. Each difference is small. Stacked, they turn a green internal map into a deficiency notice.

The fix is to test against CMS's engine before the formal review, and to treat every internal pass as unconfirmed until it does.

Below are the ten gaps we see most, grouped by where they come from: where the members are, where the providers are, who counts, and what has quietly expired. Each one comes with the CMS source that creates it. If you want the mechanics of the two tests first, start with how CMS scores Medicare Advantage network adequacy.

Where the members are

1. Your centroids are not CMS's sample

Internal tools have to put members somewhere. Most use ZIP centroids, a purchased population file or, for an operating plan, current enrollee addresses. A new entrant has no enrollees at all. CMS uses the MA Medicare Sample Census, which it describes as representative for each county and "only available to CMS." In its 2010 description of the automated review, CMS said the sample was 1.6 million records, a 3.4% sample, with coordinates plotted by an algorithm from ZIP-level enrollment, and that these "are not actual Medicare beneficiary addresses." That memo is old and the sample has surely been rebuilt since. The principle hasn't changed: you are modeling a population you will never see.

Centroids flatter you. A ZIP centroid sits near the middle of the ZIP, and in rural areas the middle is usually closer to town than the members at the edges.

The gap runs the other way too. CMS's criteria "are not restricted by state or county boundaries," so a cardiologist two miles across the state line counts for your county. An internal tool that only credits in-county providers will fail counties CMS would pass. Model with dispersed points, not centroids, and let providers from neighboring counties and states count.

Where the providers are

2. The address is where they consult, not where they bill or operate

CMS's December 2024 guidance says providers should be listed at the addresses where they see patients in an office-based setting for consultations, not where they solely perform procedures. Its own example is an orthopedic surgeon listed at the office, not the hospital. Rosters pulled from credentialing or claims systems often carry a billing address, a corporate address or a hospital. On builds we've run, this is the most common reason a specialist who "should" cover a county doesn't.

3. The same name and address, spelled the same way, every time

The same guidance says names and addresses must be submitted "exactly the same way each time, including spelling, abbreviations," and that differences can cause processing problems and network deficiencies. "Ste 200" one cycle and "Suite 200" the next is not harmless.

Then there is geocoding. CMS's 2017 criteria guidance described four statuses on the Address Information Report. "Zip-Distributive" meant the mapping software couldn't find the street address; if the ZIP was valid, the provider got a randomly generated point inside the ZIP, weighted by population density, the same point every run. "Invalid Address" meant a bad address and a bad ZIP, and the provider was left out of automated processing entirely. "Duplicate Record" meant the same county code, specialty code and NPI; a second address still helps time and distance, but the provider counts once toward the minimum. The fourth, "Not Supported by ACC," sent the record to manual review. Check the current NMM Plan User Guide for today's wording, but read that report every cycle. A Zip-Distributive provider in a large rural ZIP can land miles from the real office, and you won't know which way it moved.

4. SSA county codes are not FIPS codes

HSD tables are keyed by the five-digit SSA state and county code. Baldwin County, Alabama is 01010. Almost everything else you own, from census files to GIS layers to most vendor data, uses FIPS. They are different numbering systems. Arizona is state 03 in SSA codes and 04 in FIPS. Join on the wrong one and providers land in the wrong county, or in none. Carry both codes on every county record, and never join on county name.

Who counts

5. Specialty codes carry rules your roster doesn't

Primary care is scored as a group. CMS sums codes 001 through 006 (General Practice, Family Practice, Internal Medicine, Geriatrics, and primary care PAs and NPs) under S03. But the 2026 HSD Reference File notes limit PAs (005) and NPs (006) to a narrow case: fully credentialed as primary care, functioning as the enrollee's primary care source rather than supplementing a physician, and practicing in or serving enrollees in a designated physician shortage area. An internal report that counts every NP in a family practice is counting people CMS won't. The same notes say physical therapists are not Physiatry (026). Read the Notes tab once a year. It's short.

6. One behavioral health provider, one code

Outpatient Behavioral Health (068) arrived with the CY2025 rule. A provider submitted as Psychiatry, Clinical Social Work or Clinical Psychology cannot also be submitted under OBH. NPs, PAs and clinical nurse specialists qualify for OBH only if they furnished psychotherapy or substance use disorder prescribing to at least 20 patients in a 12-month period, and 422.116(b)(2)(xiv) has the plan verify that every year. We cover the rest in behavioral health network adequacy.

7. Telehealth-only providers don't fill the count

Under 422.116(e)(1), a telehealth-only provider does not count toward the minimum number. Telehealth earns a 10 percentage point credit on the time and distance percentage in listed specialties. That's it. A virtual psychiatry group contracted statewide can lift your rural percentage, but your internal report is wrong if it also fills the psychiatry count.

8. Credits assumed where they don't apply

Internal reports often take 10 points off the threshold everywhere. The Certificate of Need credit is not applied where the county's standards are customized. The applicant credit lasts only through the application review. Neither changes the minimum count. Apply each credit county by county, from the current Reference File, or don't apply it.

What has quietly expired

9. Letters of intent end when the contract year starts

LOIs signed by both parties can stand in for contracts in an initial or service area expansion application. Applicants mark "Y" in the LOI column and must remove it once the contract is fully executed. Once the plan is operational, the credit ends and LOIs are no longer permitted; CMS expects fully executed contracts on the HSD tables. A tracker that shows "LOI signed" as in network is overstating an operating contract. And plans that used LOIs face the triennial review in their first operational year.

10. The roster CMS sees is not the roster you maintain

Terminations lag. A provider who left in March is still green on the internal map in June. For terminations a plan considers significant, Chapter 4 of the Medicare Managed Care Manual asks for notice to the CMS Account Manager at least 90 days before the effective date, and a significant termination can trigger a network review. Section 422.111(e) separately requires enrollee notice 45 calendar days ahead for primary care and behavioral health providers, and 30 for other specialties.

Stale runs the other way as well. MedPAC reported that in 2021 the most common reason CMS denied an exception request was finding providers within the criteria that the plan had failed to include on its exception request or HSD tables. Contracted providers missing from the upload cost you as much as terminated ones left on it.

Test against the referee before the formal review

CMS gives you two ways to see its answer early. Before the formal triennial review, it offers an informal "Consultation" upload with technical assistance. And any organization with a contract ID can upload HSD tables to NMM at any time to test compliance; the ACC then scores every provider and facility type in every county. Read the "actual time" and "actual distance" fields the way the 2017 guidance defines them: the percentage of beneficiaries with access. Read the ZIP Code Report for Failed Counties to see where the misses cluster.

Before each test upload, we'd run this list:

1. Every address is the consultation office, spelled exactly as last cycle.
2. Every county code is SSA, checked against the current Reference File.
3. NPs and PAs under 005 and 006 meet the shortage-area conditions, or they come off.
4. No behavioral health provider appears under both a provider code and 068.
5. Telehealth-only providers are flagged and excluded from counts.
6. Credits are applied only where the Reference File says they apply.
7. No LOI flag remains on an operating contract.
8. Terminations since the last upload are off; new contracts are on.

Then compare the ACC to your internal report, county by county. Every disagreement is one of the ten gaps above, or a new one worth writing down.

The decision rule: an internal pass is unconfirmed until NMM agrees

Here is the rule we'd put on the wall. An internal adequacy pass is a hypothesis. It becomes a pass when CMS's engine, run on the same tables you will submit, says so. Until then it goes in the status report as "unconfirmed," and nobody stops recruiting in that county.

That rule costs little and saves the worst kind of surprise, the one that arrives in an application year as a Notice of Intent to Deny, with 10 days to respond.

It is also how Blueprint labels its own results. The adequacy engine measures straight-line distance today, so a pass shows as unconfirmed until it's measured on roads, and drive time isn't measured yet. We'd rather tell you that than hand you a green map you can't defend. You can see how it behaves on sample data on the network map.