Provider Directory Compliance:
The 72-Hour Rule and Beyond
CMS's 2024 Final Rule codified the 72-hour provider directory update requirement for Medicare Advantage plans. This guide covers what must be updated, how CMS checks compliance, and how to build a directory management system that never misses the window.
The 72-Hour Rule
What Must Be Updated Within 72 Hours
The rule covers eight trigger events. Each requires the plan to update the online provider directory within 72 hours of learning of the change — weekends and holidays included.
| Trigger Event | Deadline | Channel | Notes |
|---|---|---|---|
| Provider terminates from network | 72 hours | Online directory AND print directory (upon next request) | Most critical — terminated providers still listed cause member harm claims |
| Provider adds a new office location | 72 hours | Online directory | New locations must show full address, hours, and accessibility information |
| Provider changes their office address | 72 hours | Online directory | Old address must be removed; do not retain both without date-indication |
| Provider changes panel status (opens or closes panel) | 72 hours | Online directory | Panel status is the highest-impact field for member access and CMS secret shopper calls |
| Provider changes specialty or adds a new specialty | 72 hours | Online directory | Specialty changes can affect the plan's adequacy calculation for the affected county-specialty |
| Provider changes languages spoken | 72 hours | Online directory | Language access data feeds CMS's LEP (Limited English Proficiency) access monitoring |
| Provider changes phone number | 72 hours | Online directory | Unreachable phone numbers are a frequent secret shopper finding |
| Provider is credentialed (new to network) | 72 hours of credentialing completion | Online directory | Providers should appear in the directory on the first day they are available to members |
CMS Audit Methods
How CMS Checks Your Directory Accuracy
CMS uses four distinct methods to check directory compliance. Understanding each helps you build defenses before an audit rather than after.
Secret Shopper Calls
CMS contractors call the phone number listed in the plan's provider directory and attempt to schedule an appointment. They verify that the provider is (1) still at that location, (2) accepting new patients, (3) in-network, and (4) reachable. Failed secret shopper calls are among the most common compliance findings.
Member Complaint Analysis
CMS tracks member grievances related to provider directory accuracy. A pattern of 'provider not where listed,' 'provider not taking new patients,' or 'provider not in network' complaints triggers a targeted audit of that plan's directory.
NPPES Cross-Reference
CMS compares provider addresses, phone numbers, and specialties in plan directories against the NPPES (National Plan and Provider Enumeration System) registry. Significant discrepancies between directory data and NPPES data indicate poor data hygiene and trigger review.
Error Rate Sampling
During formal audits, CMS calculates a provider-level error rate: the percentage of sampled directory entries that contain at least one material inaccuracy. Error rates above threshold (CMS has not published a hard number, but plans should target <5%) trigger corrective action.
Accuracy Standards
Field-by-Field Accuracy Importance
Provider name
Member cannot identify or locate provider without correct name
Office address
Most common member complaint; directly causes failed appointment attempts
Phone number
Primary secret shopper test; unreachable numbers = automatic finding
Specialty
Members searching for specialists rely on this; also affects adequacy calculation
Accepting new patients
Most impactful for member access; closed-panel errors cause multiple CMS findings
Hospital affiliations
Important for members seeking hospital-based specialist access
Languages spoken
CMS monitors LEP access compliance; inaccurate language data causes access disparities
Telehealth availability
2024 Final Rule requires telehealth indicator; inaccurate data affects adequacy counting
ADA accessibility
Required under member communications guidance; affects members with disabilities
Office hours
Appointment wait time compliance requires accurate hours data
Common Violations
The Most Common Provider Directory Violations
Ghost providers
Providers listed who have terminated from the network months or years prior — the most common and most serious violation type
Stale addresses
Providers who have moved their office location but the old address remains in the directory
Closed panel listed as open
Provider shows 'accepting new patients: yes' but has closed their panel — the highest-impact member access error
Wrong specialty
Provider listed under a specialty they don't practice, or a subspecialty mapped to the wrong parent specialty
Unreachable phone number
Phone number that rings to voicemail with no return call, disconnected, or reached the wrong office
Missing telehealth indicator
Provider offers telehealth but it's not reflected in the directory, meaning the plan can't count them for telehealth adequacy purposes
Blueprint Platform
Blueprint Automates Provider Directory Compliance
Plans that manage directory updates manually face a constant race against the 72-hour window. Blueprint makes the window a non-issue by automating update propagation and monitoring.
72-Hour Monitoring Alerts
Blueprint monitors your provider roster for status changes and triggers alerts when a directory update is required within the 72-hour window. No manual tracking needed.
Directory Sync Engine
Changes made in Blueprint's CRM automatically propagate to your member-facing directory. Terminations, panel closures, and address changes update in real time.
NPPES Cross-Reference
Blueprint cross-references your directory data against NPPES on a rolling basis, flagging discrepancies before CMS's automated comparison catches them.
Audit Log Export
Every directory change is timestamped and logged. Blueprint generates a compliance-ready audit log showing update history, change triggers, and timestamps for any CMS review period.
FAQ
Provider Directory Compliance Questions
Related Resources