Provider Directory 72-Hour Update Rule: CMS Requirements and Compliance Systems

What Drove the 72-Hour Rule

The provider directory accuracy problem in Medicare Advantage is not new. CMS has documented provider directory inaccuracies in MA plans for more than a decade, and the issue consistently ranks among the top sources of member complaints and OIG audit findings. Members who rely on a plan's directory to find an in-network provider — and then discover the information is incorrect — face unexpected out-of-network costs, delayed access to care, and erosion of trust in the plan.

Prior to the 2024 Final Rule, CMS's requirements for provider directory updates were relatively open-ended. Plans were required to maintain accurate directories and to update them in a "timely" fashion, but the absence of a defined timeframe created significant variation in how plans interpreted this obligation. Some plans updated directories within days of receiving provider information changes; others allowed updates to accumulate until a monthly batch process. CMS's secret shopper testing and OIG audits repeatedly found that the batch-update approach produced directories with materially inaccurate information at any given point in time.

The 2024 Final Rule, codified at 42 CFR 422.111(h), eliminated the ambiguity by establishing a specific 72-hour maximum update window for covered changes to the online directory, and by specifying that the print directory must reflect all changes upon production or upon member request for a printed copy. The rule represents the most significant tightening of provider directory requirements since CMS first mandated electronic directories for MA plans.

What Changes Must Be Reflected Within 72 Hours

Not all provider information changes trigger the 72-hour update obligation. CMS's final rule and the accompanying preamble commentary distinguish between "covered changes" — which must be reflected within 72 hours — and other updates that remain subject to the general accuracy standard without a defined timeframe.

Covered changes under the 72-hour rule include:

• Provider terminations: When a provider terminates their contract with the plan — whether voluntarily, through mutual agreement, or through the plan's termination of the contract — the provider must be removed from the online directory within 72 hours of the effective date of the termination. The 72-hour clock runs from the effective date of the termination, not the date the plan's internal systems are notified, which creates an important documentation obligation around the effective date of every termination.
• Panel status changes: When a previously accepting provider closes their panel to new MA patients, the directory must reflect this change within 72 hours of the plan receiving notification of the closure. This is one of the most operationally challenging covered changes because providers often notify plans informally — by phone, email, or through a billing intermediary — rather than through a formal written notification.
• Practice address changes: When an in-network provider relocates their primary practice location, the updated address must appear in the online directory within 72 hours of the plan receiving notification of the change.
• Specialty changes: When a provider changes their primary specialty designation — for example, a physician who discontinues a subspecialty practice — the directory must be updated within 72 hours.
• Hospital affiliation changes: When a provider changes their primary hospital affiliation, this must be updated within 72 hours if the affiliation information is included in the directory (which is required for providers with hospital privileges).

Changes that are not classified as "covered changes" subject to the 72-hour rule include additions of new providers to the network (where no urgency exists for member protection), updates to provider biographical information such as languages spoken or office hours, and corrections to administrative data elements that do not affect a member's ability to locate or access the provider.

What "Update" Means in CMS's Definition

One of the interpretive questions that arose immediately after the 2024 Final Rule was published is what CMS means by "update" in the context of the online directory. Does a 72-hour update mean that the change must be submitted to the directory system within 72 hours, or that it must be visible to members within 72 hours?

CMS's preamble commentary makes clear that the obligation runs to member-visible accuracy — the update must be reflected in what a member (or a CMS secret shopper) would see when they access the plan's online directory. This distinction matters enormously for plans whose directory management involves multiple internal handoffs: the provider relations team receives notification of a change, enters it into the provider management system, which then feeds a data warehouse, which then exports to the public-facing directory on a batch schedule. If that batch schedule runs weekly, the plan cannot comply with the 72-hour rule regardless of how quickly the initial data entry occurs.

Plans must therefore evaluate their end-to-end data flow from notification receipt to public directory display and eliminate any batch processing delays that would prevent 72-hour member-visible updates. For many plans, this requires either moving to near-real-time API-based directory updates or implementing a manual override process for covered changes that bypasses the standard batch schedule.

The Print Directory: What the Rule Requires

The print directory obligation under the 72-hour rule is structured differently from the online directory obligation, and compliance teams should not conflate the two. CMS recognizes that print directories cannot be updated in real time — the cost and logistics of reprinting and mailing a directory to all members every time a provider change occurs would be prohibitive.

Instead, the 2024 Final Rule requires that the print directory reflect all covered changes in two specific circumstances: (1) when the directory is next produced for distribution (typically at the beginning of each benefit year), and (2) upon a member's specific request for a printed directory copy. In the latter case, the plan must provide the member with a printed directory that reflects the current state of the network as of the date of the request — not as of the last bulk printing date.

This creates an operational requirement that most plans have not historically built into their workflows: the ability to produce on-demand printed directories that reflect current network data. Plans that fulfill member print directory requests by mailing the most recent bulk-printed version — which may be months out of date — are not in compliance with the 2024 Final Rule if that version does not reflect changes that have occurred since printing.

CMS's Audit Methodology for Directory Compliance

CMS audits provider directory accuracy through a combination of secret shopper testing (described in detail in the companion article on the secret shopper program) and desk-based audits that compare the plan's directory data at a point in time against external reference data and the plan's own internal records of provider changes.

The desk-based audit methodology involves CMS requesting, from the plan, a snapshot of the plan's provider directory data as of a specific date. CMS then cross-references this snapshot against NPPES data (to identify providers whose address, phone, or specialty information differs materially between the plan's directory and the NPPES record) and against any provider termination or change notifications that the plan's own records show as having occurred before the snapshot date. If the plan's directory shows a provider as active and accepting patients when the plan's own records indicate the provider terminated their contract 10 days before the snapshot date, that is a clear 72-hour rule violation.

CMS also uses beneficiary complaints as an audit input. When a member files a complaint alleging that they relied on a directory listing that proved inaccurate — for example, that they traveled to a provider's listed address only to find the provider had relocated — CMS can use the complaint date, the inaccurate information complained about, and the plan's directory records to reconstruct whether the plan was in compliance with the 72-hour update rule at the time of the member's directory access.

Error Rate Thresholds Before Enforcement Action

CMS has not publicly codified a single, specific error rate threshold above which enforcement action is automatic. However, the 2024 Final Rule preamble and subsequent CMS guidance have established a framework for understanding how error rates translate into enforcement risk.

For the 72-hour online directory update obligation, CMS evaluates compliance based on the plan's documentation of when it received covered-change notifications and when the corresponding directory update became member-visible. A plan that can demonstrate consistent 72-hour compliance with a small number of documented exceptions (where the exception was caused by a provider failure to notify rather than a plan process failure) is unlikely to receive a formal deficiency notice based on a desk audit.

A plan that cannot produce documentation of its notification-to-update timelines — or whose documentation reveals systematic delays above 72 hours — faces a higher enforcement risk. CMS has indicated in compliance training materials that plans should expect enforcement inquiry when their audit results show that more than 5% of covered changes in a given audit period were not reflected in the online directory within 72 hours of the effective date of the change.

For directory accuracy more broadly (inclusive of but not limited to 72-hour compliance), the secret shopper program's methodology uses a 10% error rate threshold as a general benchmark above which formal findings are issued. Plans with error rates between 5% and 10% may receive informal corrective action requests; those above 10% typically receive formal deficiency notices.

Building a Compliant Directory Management Workflow

Compliance with the 72-hour rule requires a process architecture that most plans have had to redesign since the 2024 Final Rule was finalized. The following workflow elements are characteristic of plans that consistently meet the standard:

• Notification intake with timestamp logging: Every provider change notification — regardless of how it arrives (phone, email, portal, fax, EDI transaction) — must be logged with the timestamp of receipt. This timestamp is the start of the 72-hour clock for covered changes and is the evidentiary foundation for demonstrating compliance in an audit.
• Triage of covered vs. non-covered changes: The intake process must include a classification step that identifies covered changes subject to the 72-hour rule and routes them to an expedited update queue separate from routine updates. Plans that process all changes through the same workflow inevitably prioritize by volume rather than regulatory urgency.
• API-based directory update capability: Plans whose public-facing online directory is updated only through batch processes will not be able to meet the 72-hour standard for covered changes. At minimum, the directory management system must support an override mechanism that allows a covered change to be reflected in the public directory outside the standard batch cycle.
• 72-hour compliance monitoring: The plan's compliance team (or the directory management team) should run a daily or near-daily report that flags any covered changes for which the notification-to-member-visible-update elapsed time is approaching or has exceeded 72 hours. This monitoring should be automated where possible and should generate an escalation alert for any change that has not been reflected in the directory within 60 hours of the notification timestamp.
• Documentation retention: All notification records, timestamp logs, and directory update confirmation records should be retained for a minimum of 10 years, consistent with the MA contract record retention requirements in 42 CFR 422.504(d). CMS audits can request documentation going back multiple benefit years, and the absence of documentation is treated as equivalent to non-compliance for audit purposes.

Plans that have implemented these workflow elements report that the ongoing operational burden is manageable — the primary challenge is the upfront investment in system architecture and process design. Plans that attempt to meet the 72-hour rule through manual processes alone, without system support, consistently find that the standard is not sustainable at scale.