On October 16, CMS proposed a set of Medicare Advantage reforms aimed squarely at ghost networks: plans would have to verify their provider directories at least every 90 days, report an accuracy score, and cap a member's cost sharing at in-network levels when the member relied on a bad listing.

Most coverage has treated this as a plan problem. It is not only a plan problem. Buried in the proposal is a requirement that MA plans write directory accuracy into their provider contracts. If it is finalized, your roster data stops being an admin chore and becomes a contractual obligation, with the plan's cost-sharing exposure sitting on the other side of it.

I spent years as head negotiator for network management in Humana's West Territories before building Carenodes and viperOS. Here is how I would read this proposal from the provider side of the table.

What CMS actually proposed

According to the American Academy of Ophthalmology's summary of the rule, starting in 2028 MA plans would need to:

  • Verify directory information at least every 90 days.
  • Update the directory within 30 days of receiving new information.
  • Remove providers within five business days of determining they are no longer in network.
  • Flag information that cannot be verified with a notice that it may be outdated.
  • Run annual accuracy assessments, report them to CMS, and from 2029 display accuracy scores in their directories.

The AAMC notes that CMS proposed a letter-grade scoring method and that providers "will be asked to confirm information more often." Comments are due December 15, 2026.

The scale of the problem is not small. The AAO reports that across the location listings CMS reviewed, the inaccuracy rate was 44.29%, and even the best-performing specialty it examined, ophthalmology, came in at 38.34%.

This also builds on what is already live. For the 2027 plan year, insurers send their directory data straight to Medicare Plan Finder, attest to it, and must update it within 30 days of a change, as Wendell Potter laid out ahead of open enrollment. The data still comes from the plans, and the plans get much of it from you.

Why this lands on your side of the table

Two provisions matter most for provider groups. Per the AAO summary, plans would need contract terms requiring participating providers to:

  1. Keep directory information accurate and current, including practice locations and contact details.
  2. Produce documentation of the earliest date an appointment was scheduled, on request, so the plan can decide whether a member qualifies for the cost-sharing protection.

Think about the incentives. If a member books with you while you are listed as in network, and you are out of network by the date of service, the plan eats the difference between in-network and out-of-network cost sharing. Plans will want that risk managed, and the cheapest place to manage it is in the provider agreement.

Expect three things over the next renewal cycle:

  • More verification requests. Every 90 days, per plan, per location. If you hold a dozen MA contracts, that is a steady stream of attestations your team has to answer.
  • Amendment language. Directory accuracy clauses, response windows and documentation duties will show up in amendments and renewals.
  • Faster consequences. A five-business-day removal standard means a plan that believes you have left its network, rightly or wrongly, can take you out of the directory quickly.

Credentialed is not contracted, and listed is not paid

Here is the gap I see constantly. Credentialing approval, network enrollment, the contract effective date, the directory listing and the fee schedule loaded in the claims system are five different records, often owned by different teams on the payer side. Providers tend to assume that once credentialing clears, the rest follows. It frequently does not.

A new location that was credentialed but never added to the roster. A provider who left the group but is still listed. A tax ID change that updated enrollment but not the directory. Each of those is now a potential directory error under a regime that scores, publishes and, through the contract, assigns responsibility for accuracy.

The same data drives your revenue. A location that is wrong in the directory is often wrong in the roster that determines which fee schedule pays the claim. The groups that clean up their directory data for compliance reasons will usually find payment problems along the way.

CMS is pushing the same direction in Medicaid. Its Program Integrity Pillars for Medicaid and CHIP describe provider enrollment checks run "both at enrollment and on an ongoing basis." Enrollment is no longer a one-time event in any line of business.

What to negotiate when the amendment arrives

The proposal is not final, and plans will draft their own language. When directory clauses show up, these are the points I would push on:

  • Define the data. Which fields are you responsible for, and in what format? Vague "keep information accurate" language invites disputes.
  • One channel, reasonable windows. Insist on a single intake channel per plan and a response window your team can actually meet.
  • Notice and cure before removal. Ask for written notice and a cure period before a listing is pulled or treated as a contract breach.
  • Allocate the cost-sharing risk fairly. If the plan's own system caused the error, the provider should not absorb the member's cost-sharing difference. Watch indemnification and offset language closely.
  • Tie the directory to the roster. Ask that directory updates you submit also update the roster and fee schedule mapping, with confirmation back to you.

Practical takeaways for provider groups

  1. Build a single source of truth. One record per provider, per location, per payer: credentialing status, enrollment status, contract effective date, directory listing, loaded fee schedule.
  2. Reconcile before the plans do. Pull each MA plan's directory listing for your providers now and compare it to your roster.
  3. Log appointment-scheduled dates. Make sure your scheduling system can produce the date an appointment was first booked. You may be asked for it.
  4. Calendar 90-day attestation cycles for every MA contract, with an owner.
  5. Read your next amendment for directory language before you countersign.
  6. Comment by December 15. Provider input on response windows and cure periods matters while the rule is still a proposal.

The bottom line

Ghost networks are a real problem for patients, and CMS is right to go after them. But a directory is only as accurate as the enrollment and contract data behind it, and this proposal moves responsibility for that data into your agreements. The groups that treat credentialing, enrollment, directory and contract data as one system will handle this easily. The ones that treat them as five separate chores will pay for it in admin time, disputes and missed revenue.

That is the work we built viperOS around with Viper Health: connecting network enrollment, contract intelligence and fee schedule data so the record matches the money. If you want a quick sense of what cleaner enrollment and contract data is worth to your group, run your numbers through the ROI calculator.