Inside CMS's Network Adequacy Review: What Happens After You Submit

The Moment the Clock Starts

When a Medicare Advantage organization submits its network adequacy data through the Health Plan Management System (HPMS), the filing doesn't land in an inbox for a human reviewer to open Monday morning. It enters an automated validation pipeline that begins running within minutes of submission. Understanding what that pipeline checks — and where it hands off to human reviewers — is one of the most underappreciated aspects of successful network adequacy management.

Plans that treat submission as the finish line often find themselves caught flat-footed by deficiency notices that arrive weeks later. Plans that understand the review workflow can anticipate where CMS will look, what databases it will cross-reference, and what patterns of data will draw a closer look from the analysts on the other end.

HPMS Automated Validation: The First Filter

HPMS runs a series of automated validation checks against every network adequacy submission before it reaches a human reviewer. These checks operate against CMS's own reference data sets and are designed to catch the most common structural problems in filings:

• NPI validation: Every provider NPI submitted is cross-checked against the National Plan and Provider Enumeration System (NPPES) to confirm the NPI is active, the provider type matches the specialty category claimed, and the practice address on file matches (within a defined tolerance) what the plan submitted.
• Enrollment status: HPMS cross-references provider NPIs against the Medicare Provider Enrollment, Chain, and Ownership System (PECOS) to confirm the provider is currently enrolled in Medicare — a requirement under 42 CFR 422.204(b). Providers who have opted out of Medicare or whose enrollment has lapsed cannot be counted toward adequacy thresholds.
• Duplicate detection: The system flags NPIs submitted in multiple specialty categories where the provider's NPPES taxonomy does not support the additional specialty. A primary care physician listed as both a PCP and a cardiologist, for example, will trigger an automatic flag.
• Threshold calculation: Using the county-level provider coordinates and the CMS time-and-distance model, HPMS calculates whether the submitted network meets the published thresholds for each specialty in each county in the plan's service area. Counties and specialties that fall below threshold are flagged for further review.

This first-pass automation typically resolves within 24 to 72 hours of submission. Plans can monitor the status of their filing through the HPMS module. A filing that clears automated validation does not move to immediate approval — it advances to analyst queue for manual review of flagged items and a sample review of clean items.

How HPMS Flags Deficiencies Before a Human Sees Your Filing

The automated flags generated by HPMS serve as the primary input for human reviewers. CMS analysts do not start from scratch; they work from a prioritized queue of flagged items. Understanding what elevates a flag's priority is therefore critical for predicting where reviewer attention will focus.

High-priority flags typically include: counties where the plan falls below 80% of the required threshold for any specialty (what CMS internal guidance sometimes refers to as a "significant gap"); specialties that were flagged in the same county in the prior benefit year (repeat gaps); and any provider submitted as fulfilling more than two specialty categories simultaneously, which suggests the plan may be artificially inflating its network count.

Lower-priority flags — which may be resolved with less intensive review — include minor address discrepancies for otherwise validated providers, single-provider counties where the provider is verified but thin coverage is noted, and counties where the plan has submitted an exception request alongside the gap.

The Role of NPPES and External Databases in Provider Validation

CMS does not rely solely on what plans report. The network adequacy review process uses NPPES as its primary external reference, but reviewers also draw on several additional databases during manual review:

• PECOS: Confirms active Medicare enrollment and flags any opt-out elections or revocations that would disqualify the provider from counting toward adequacy.
• LEIE (HHS OIG List of Excluded Individuals/Entities): Providers on the exclusion list cannot be counted, and CMS reviewers check this as part of their standard validation for any manually reviewed provider.
• State licensure databases: For specialties where CMS has reason to question a provider's credentials (usually surfaced by a prior-year finding or a complaint), reviewers may check state medical board licensure status directly.
• CMS claims data: For high-volume specialties, CMS may cross-reference the plan's submitted network against its own claims data to determine whether submitted providers are actually billing and being paid by the plan. A provider listed as in-network who has zero claims activity over the prior 12 months may be flagged as a "paper" network provider under the standards articulated in 42 CFR 422.116(b).

Plans should be prepared for the possibility that CMS's external validation will surface discrepancies with their own internal data. When this happens — and it happens more frequently than most plans expect — the resolution process requires the plan to provide documentation supporting its own data or to acknowledge and remove the provider from the network count.

Automated vs. Human Review: Where the Handoff Happens

Once automated validation is complete, the filing moves to one of three tracks. Clean filings — those with no automated flags and no prior-year deficiency history — move to a light-touch human review that confirms the automated validation results and checks a statistical sample of providers. These filings can receive approval within two to four weeks of submission depending on the volume of filings CMS is processing.

Filings with automated flags but no prior-year deficiency history enter the standard analyst queue. A CMS analyst reviews each flagged item, cross-references the external databases described above, evaluates any exception requests submitted by the plan, and either resolves the flag or escalates it to a senior analyst for a deficiency determination.

Filings with prior-year deficiencies or a history of corrective action receive the most intensive review. These filings are assigned to senior analysts and may be subject to a more comprehensive audit that goes beyond the flagged items to include a broader review of the plan's provider data quality.

Common Patterns That Trigger Manual Review

Beyond automated flags, certain patterns in a filing reliably attract deeper manual scrutiny. Compliance teams should treat these as yellow flags during their own pre-submission review:

• Large year-over-year network changes: A network that contracts significantly between the prior year and the current submission — particularly in high-scrutiny specialties — will prompt a reviewer to ask what happened. Plans should be prepared to document provider terminations, service area changes, or market exits that explain the change.
• Geographic clustering of providers: A network in which a large share of providers in a given specialty are clustered in a single location (often a hospital system or large group practice) will receive scrutiny about whether those providers are realistically accessible to members across the service area.
• Exception requests in the same county and specialty for multiple consecutive years: CMS's Final Rule commentary has explicitly noted that repeat exception filings without evidence of active outreach and recruitment are viewed unfavorably. Reviewers are instructed to look for documentation of genuine recruitment efforts.
• High ratios of providers to beneficiaries in certain specialties combined with gaps in others: A plan that is heavily overbuilt in primary care but thin in behavioral health or oncology will attract attention, as this pattern can suggest the network was built to satisfy broad adequacy metrics rather than genuine member access.

The Timeline from Submission to Approval or Deficiency Notice

CMS does not publish a guaranteed review timeline, but the practical cycle for most benefit year submissions runs as follows. Initial automated validation completes within one to three business days. Standard analyst review, for filings without significant flags, runs four to eight weeks. Filings with significant flags or prior-year history may not receive a determination for ten to fourteen weeks from submission.

When CMS issues a deficiency notice, it arrives through the HPMS messaging system and typically contains a deficiency detail report listing each county, specialty, and provider category where the filing falls short, along with the specific threshold that was not met and the number of additional providers needed to reach compliance. The notice also specifies a response deadline — typically 30 days for initial deficiency responses, though CMS has the authority to grant extensions for complex situations.

Plans that receive a deficiency notice should not wait for the deadline to begin remediation work. The 30-day window is often insufficient to contract new providers, complete credentialing, and resubmit if the plan starts from scratch on receipt of the notice. Best practice is to maintain an active pipeline of providers in credentialing for precisely this scenario.

How to Read a Deficiency Notice When It Arrives

A CMS network adequacy deficiency notice contains several components that compliance teams need to interpret correctly to respond effectively. The deficiency detail report is the core document. It lists each deficient county-specialty combination, the threshold that applies (expressed as a percentage of beneficiaries within the time-and-distance standard, under 42 CFR 422.116(a)), the plan's current compliance percentage, and the gap.

The notice will also specify whether the deficiency is classified as a "significant" gap (generally, below 85% threshold compliance) or a "minor" gap (85% to just below 100%). Significant gaps typically require a corrective action plan (CAP) in addition to the remediation filing. Minor gaps may be resolved through a supplemental network submission without a formal CAP, depending on the plan's history.

Critically, the deficiency notice will reference the applicable regulatory citations — typically 42 CFR 422.116 for network adequacy standards and 42 CFR 422.504 for the general compliance requirements — and the specific HPMS data elements that are deficient. Plans should map these citations to their internal data and processes to identify the root cause of the deficiency before drafting their response.

A well-structured deficiency response addresses three things: the immediate remediation (new providers contracted and credentialed to fill the gap), the root cause analysis (why the gap existed in the first place), and the process improvement (what the plan is changing to prevent recurrence). CMS reviewers evaluate all three components when deciding whether to accept the response or escalate to formal enforcement under 42 CFR 422.752.