If you’ve ever told a client “let me double-check that your doctor takes this plan,” you already know the honest answer isn’t a quick lookup — it’s a phone call, because Medicare Advantage provider directories have a documented, decades-long accuracy problem that CMS itself is only now forcing plans to fix directly. Starting with the Contract Year 2027 Medicare Plan Finder, which goes live October 1, 2026, every Medicare Advantage organization has to submit its provider directory data straight to CMS in a standardized format, with a company officer personally attesting the data is accurate — a real regulatory shift, but one CMS admits won’t independently verify a single listing (CMS, DRAFT Technical Implementation Guide for Supplying MA Provider Directory Data for Use in MPF, November 7, 2025). This article walks through what’s changing, what the data actually shows about how bad the problem is today, and the exact manual method for confirming a client’s doctor is really in-network — the same method CMS’s own reviewers use.
Key takeaways
- HHS OIG found that an average of 55% of Medicare Advantage behavioral health network providers had zero encounters with any of that plan's members in 2023 — and 72% of those inactive listings should never have been in the directory at all (HHS OIG, OEI-02-23-00540, October 2025).
- Starting with CY2027, MA organizations must submit provider directory data to CMS as a machine-readable JSON file or a FHIR-based API, updated within 30 days of a known change, with a CEO, CFO, or COO personally attesting annually that it's accurate (Federal Register, CMS-4208-F2, September 19, 2025).
- CMS says outright that its new validation process checks format and freshness, not accuracy — "data accuracy is the responsibility of the MA plan" (CMS, DRAFT Technical Implementation Guide, November 7, 2025).
- The CY2027 Medicare Plan Finder is scheduled for production release October 1, 2026, with plans attesting to CMS no later than September 1, 2026.
- A three-question phone call to the provider's office — sees patients here, accepts this plan here, accepting new patients — is still the only method that actually confirms a listing, and it's free.
- Ambrose's marketplace-finder and plan-quoter spokes speed up the plan-comparison side of this work; neither is documented as verifying provider network accuracy, and no tool currently does that, including CMS's own.
What a “ghost network” actually is, and why the term isn’t hype
“Ghost network” sounds like a phrase a marketing team invented, but it’s the term HHS’s Office of Inspector General uses in its own October 2025 report: a plan’s provider directory that lists a doctor, therapist, or facility that isn’t actually available to see that plan’s members, “such as providers who have retired or changed locations” (HHS OIG, OEI-02-23-00540, October 2025). The directory says the provider is in-network. The provider, if you actually call, either doesn’t work there anymore, never signed a contract with that specific plan, or stopped taking new patients years ago and nobody removed the listing. The network looks bigger and more accessible on paper than it is when a real person tries to book an appointment.
OIG’s most recent data on this is specific to behavioral health — psychiatrists, psychologists, and clinical social workers — because that’s what the 2025 review focused on, and it’s worth being precise about that scope rather than stretching it to every specialty. The review looked at 33 Medicare Advantage plans and 19 Medicaid managed care plans across 10 counties in five states, using 2023 encounter data to determine which network providers actually saw a plan’s members at all that year (HHS OIG, OEI-02-23-00540, October 2025). The finding: on average, 55% of the behavioral health providers listed in a Medicare Advantage plan’s network had zero encounters with that plan’s enrollees in 2023 — meaning more than half the names on the list, on average, produced no actual care. In Medicaid managed care, the average was lower but still substantial, at 28%.
OIG went a step further and actually called a random sample of those inactive providers to find out why. Based on 247 survey responses, 72% of inactive providers should not have been listed as network providers in the first place. Broken down: 46% of inactive providers didn’t work at any of the locations the directory listed for them — some had retired years earlier, one hadn’t worked at the listed clinic in more than a decade — 21% said they never accepted patients under that specific managed care plan, and 5% held administrative roles and didn’t see patients directly at all (HHS OIG, OEI-02-23-00540, October 2025). The remaining 28% were providers who theoretically could have served as network providers, but 72% of that group cited a real barrier — wrong contact information, no availability, or a patient population that didn’t match Medicare enrollees at all.
| Reason for inactivity | Share of inactive providers surveyed |
|---|---|
| Never worked at any location the directory listed | 46% |
| Never accepted patients under that specific plan | 21% |
| Administrative role, no direct patient care | 5% |
| Potentially legitimate, but cited a real access barrier | 28% |
This isn’t the first time CMS has measured this. Back in a 2016-2017 review round covering 64 Medicare Advantage organizations and four provider types — cardiology, oncology, ophthalmology, and primary care — CMS reviewers called 14,869 listed provider locations directly and found 52.20% had at least one inaccuracy: wrong location, wrong phone number, or wrong information about whether the provider was accepting new patients. The average inaccuracy rate across all 64 plans was 48.39%, and the majority of plans landed between 30% and 60% inaccurate (CMS, Online Provider Directory Review Report, 2018). That data is close to a decade old now, and it’s a different set of specialties than OIG’s 2025 review, so treat the two figures as two independent snapshots rather than the same number reappearing — but they land in the same range, which is exactly why this has stayed a live regulatory problem for this long instead of getting fixed once and closed out.
What it costs when a client’s “in-network” doctor isn’t really available
The direct cost lands on the client first: they enroll in a plan partly because their doctor is listed as in-network, and then they can’t actually get an appointment, because the listing was wrong. For behavioral health specifically, where OIG found Medicare Advantage plans included an average of just 16% of a county’s behavioral health workforce in their networks in the first place — compared to 31% for Medicaid plans in the same counties — a ghost-network listing isn’t a minor inconvenience layered on top of a decent network; it’s often the only listed option in that specialty for that plan in that county (HHS OIG, OEI-02-23-00540, October 2025). Three-quarters of the Medicare Advantage plans OIG reviewed had “limited” behavioral health networks, meaning less than 25% of the county’s workforce was included at all.
The cost lands on you next, and it’s not abstract. If you recommended that plan, in part, because the directory showed the client’s psychiatrist or their preferred cardiologist as in-network, and it turns out that provider hasn’t seen a patient on that plan in years, the client’s complaint is going to trace back to your recommendation before it traces back to CMS’s data pipeline. That’s a service issue at best and an E&O exposure at worst, and it’s avoidable with a five-minute phone call — which is exactly the manual method later in this article.
The directory told the client their doctor was in-network. The provider's front desk had no idea what plan the client was talking about. That gap is where the complaint lands, and it lands on the agent who recommended the plan, not on the directory.
Mike MooreThere’s a mechanism behind why providers end up as ghosts in the first place, and it’s worth understanding because it explains why this keeps happening instead of getting fixed once. OIG’s surveyed providers pointed to two recurring reasons for not staying active on a managed care plan’s panel: administrative burden, cited by 21% of respondents, and low payment rates, cited by 14% (HHS OIG, OEI-02-23-00540, October 2025). One provider in the report described updating directory information for an average of 20 different payers per practice, each with its own IT system, its own login, and its own reporting format — a workload that falls on the provider’s office, not the plan, and one that makes it genuinely easy for a listing to go stale the moment a provider stops bothering to keep up. Group practices compound the problem by listing a provider at every location the group operates, regardless of whether that specific provider actually sees patients at each one — a pattern CMS’s own 2018 review flagged as a “common driver of deficiencies” (CMS, Online Provider Directory Review Report, 2018).
CMS’s older review also found something worth sitting with: plans “placed full faith in credentialing services and vendor support, and even in provider responses,” instead of independently checking whether a listing was still true, and reviewers found cases where a directory had been wrong “for a long period of time, including cases where providers had been retired or deceased for years” — one listing hadn’t been corrected in more than a decade (CMS, Online Provider Directory Review Report, 2018). Nobody along the chain — the provider’s office, the plan’s credentialing team, or CMS’s own periodic reviews — owned the job of actually confirming the listing was still current. That’s the structural gap the CY2027 rule is trying to close on the submission side, even though, as the next section covers, it still doesn’t touch the accuracy side.
What CMS is actually changing for 2027
Here’s the regulatory mechanism, because “CMS is fixing provider directories” undersells what’s actually required and what isn’t. On September 19, 2025, CMS finalized a rule establishing new requirements at 42 CFR 422.111(m): every Medicare Advantage organization must (1) make its provider directory data available to CMS/HHS for publication on Medicare Plan Finder, (2) submit that data in a format and timing CMS specifies, (3) update it within 30 days of becoming aware of a change, and (4) attest at least annually that the submitted information is accurate (Federal Register, CMS-4208-F2, September 19, 2025). The rule took effect November 17, 2025, and applies starting January 1, 2026.
CMS is rolling this out in three phases. Phase one, already live for CY2026, is an interim fix: CMS partnered with a vendor, SunFire Matrix, to supply in-network provider and facility data for most individual Medicare Advantage plan types, and if an organization doesn’t participate, Medicare Plan Finder just links out to that plan’s own directory instead (CMS, HPMS memo, August 25, 2025). Phase two, starting with Contract Year 2027, is the real structural change: MA organizations submit their directory data either as a machine-readable JSON file — modeled on the format ACA Marketplace insurers have used since a 2015 rule — or as a FHIR-based API conforming to the PDex Plan-Net standard, and CMS crawls those files daily to pull in provider and facility records (CMS, DRAFT Technical Implementation Guide, November 7, 2025). Phase three is further out: a National Provider Directory, announced at a White House event on July 30, 2025, intended to eventually consume every MA plan’s FHIR feed directly.
You don’t need to understand FHIR or JSON to know why this matters, but the plain-English version helps: both formats are structured data files, not web pages, built so a computer — in this case, CMS’s daily crawler — can read every provider’s name, NPI number, address, specialty, and plan affiliation without a human clicking through a website. Each record has to name the exact provider by their 10-digit National Provider Identifier and the exact plan by its CMS contract, plan, and segment ID, down to the individual location where they practice. That structure is what makes the daily crawl possible — CMS isn’t reading a webpage anymore, it’s ingesting a database. What it still can’t do from that file alone is call the phone number in it and confirm someone picks up.
| Date | What happens |
|---|---|
| February 2, 2026 | MA plans can start entering their provider directory API URLs in CMS's HPMS system |
| May 4 - August 31, 2026 | CY2027 plan testing period — CMS crawls and validates plan-submitted data daily to simulate production |
| September 1, 2026 | Deadline for each MA organization's CEO, CFO, or COO to complete the annual accuracy attestation |
| September 18, 2026 | Target deadline for production-ready CY2027 data to be live on plans' API URLs |
| October 1, 2026 | Production release of the CY2027 Medicare Plan Finder |
CMS is not checking whether the listings are true
Read CMS's own technical guidance carefully: "The process outlined above will not validate the accuracy of the provider directory information submitted by MA organizations. Data accuracy is the responsibility of the MA plan" (CMS, DRAFT Technical Implementation Guide, November 7, 2025). The daily crawl checks whether the file is formatted correctly, whether it covers every required plan, and whether it's been updated in the last 30 days. It does not call the provider's office to confirm anyone actually works there. A ghost listing that's perfectly formatted and refreshed on schedule sails through validation without a hitch.
The attestation requirement is the sharpest new piece of accountability here. Under the new rule, the person signing off isn’t a compliance analyst — it has to be the organization’s CEO, CFO, or COO, personally attesting in CMS’s system that the provider directory data is “accurate, complete, and truthful at the time of the attestation to the best information, knowledge, and belief of the MA organization” (CMS, DRAFT Technical Implementation Guide, November 7, 2025). That’s a real signature on a real claim, and it raises the stakes for plans to actually clean up their data before September 1, 2026 — but it’s still an attestation based on the plan’s own review process, not an independent audit. It’s a meaningfully higher bar than what existed before. It is not proof.
The manual method: how to actually verify a network, by hand, today
None of this requires software, a paid tool, or a membership. Here’s the complete method — the same three-question structure CMS’s own reviewers used in 2016-2017 and HHS OIG used again in its 2024 provider survey, because it’s the only approach that reaches the actual provider instead of trusting a listing (CMS, Online Provider Directory Review Report, 2018; HHS OIG, OEI-02-23-00540, October 2025).
Pull the listing from Medicare Plan Finder
Search the specific plan on medicare.gov's Plan Finder and note exactly what it shows for the provider: name, address, phone number, and whether it says they're accepting new patients. This is your starting point, not your answer — remember that CMS's own validation of this data checks formatting, not truth.
Cross-check the carrier's own directory
Every Medicare Advantage organization also maintains its own searchable online directory, required under 42 CFR 422.2265(b)(4) and generally updated within 30 days of a known change or quarterly, whichever your carrier's process follows. Pull that listing too. If the phone number, address, or accepting-new-patients status differs from what Medicare Plan Finder shows, that mismatch alone is worth flagging before you call.
Call the provider's office and ask three questions
Does the provider see patients at this location? Does the provider accept this specific plan at this location? Is the provider currently accepting new patients under this plan? Ask them in that order, and ask about the specific plan by name — "do you take Medicare" and "do you take [Carrier] Medicare Advantage plan H1234-001" get very different answers from a front desk.
Write down the date, the name, and the answer
A verification with no record is worth nothing six months later when a client complains. Log the date you called, who you spoke to, and exactly what they told you — the same documentation habit that protects you if a directory turns out to have been wrong despite your best-faith check at the time.
Re-verify at every enrollment period, not just once
A plan only has to update its directory within 30 days of becoming aware of a change, which means a verification from January can be stale by October's Annual Election Period. Build re-verification into your AEP prep checklist for every client with a specialist relationship that matters to them, not just new enrollments.
Tell the client what you find, good or bad
If the provider confirms everything, tell the client you personally verified it and when. If something doesn't match, that's information the client needs before they enroll, not after their first denied claim — and it's exactly the kind of finding that should change which plan you actually recommend.
Worked example
Medicare Plan Finder lists Dr. Alvarez as in-network at a cardiology practice on Main Street, accepting new patients. The carrier's own directory shows the same address but no note on new-patient status. You call the practice: the receptionist says Dr. Alvarez moved to a different office across town two years ago, still takes the plan, but has a three-month wait for new patients. None of that matches what either directory said — and now you know it before your client does, which is the entire point of the call.
A free federal lookup most agents haven’t used: NPPES
Before you even pick up the phone, there’s a free federal database that catches some mismatches in seconds: the National Plan and Provider Enumeration System, or NPPES, at npiregistry.cms.hhs.gov. Every licensed provider with an NPI is in it, along with their registered specialty taxonomy code and primary practice address — the same registry HHS OIG’s own reviewers used to cross-check state licensing data against plan directories when a state licensing board didn’t maintain NPI numbers itself (HHS OIG, OEI-02-23-00540, October 2025). Search a provider by name or NPI, and compare what NPPES shows for their practice address against what the plan’s directory says. If they don’t match — a suite number that’s different, a practice that moved to a new building — that’s a strong signal the directory listing is stale before you’ve made a single call, and it tells you exactly what to ask about when you do call.
NPPES won’t tell you whether a provider accepts a specific Medicare Advantage plan or whether they’re taking new patients — it’s a registry of who’s licensed and where they’re registered to practice, not a network-participation database. Use it as your first pass to flag obvious mismatches, then use the phone call to confirm the thing NPPES can’t answer: whether this specific provider actually sees patients on this specific plan.
This isn’t unique to Medicare Advantage, or to behavioral health
The ACA Marketplace has actually required something similar longer than Medicare Advantage has. A February 2015 CMS rule required Qualified Health Plan issuers on the federally-facilitated Marketplace to maintain machine-readable JSON provider directory files on public URLs — and CMS is reusing that exact file format as one of the two accepted options for Medicare Advantage plans starting in 2027, specifically because it’s a format the industry already knows how to build (CMS, DRAFT Technical Implementation Guide, November 7, 2025). If you sell ACA plans, the same core lesson applies: a correctly formatted, on-time directory file is not the same claim as an accurate one, and the same three-question phone call is the way to actually confirm a listing for a marketplace client.
The behavioral health scope of OIG’s most recent data is also worth being honest about rather than stretching. CMS’s older, broader 2016-2017 review covered cardiology, oncology, ophthalmology, and primary care — not a single mention of behavioral health — and still found a comparable overall inaccuracy rate of 52.20% (CMS, Online Provider Directory Review Report, 2018). That’s the strongest evidence this is a directory-maintenance problem across specialties, not something specific to mental health providers. It happens to be worse right now in behavioral health for a reason OIG’s providers explained directly: low payment rates and heavy administrative burden push behavioral health clinicians out of managed care panels faster than they push out other specialties, and the directory often doesn’t catch up.
Where Ambrose fits, and where it honestly doesn’t
The plan-comparison side of a client conversation — pulling current premiums, subsidy eligibility, and plan attributes across ACA, ICHRA, and Medicare — is where Ambrose’s spokes actually help. marketplace-finder is documented as live healthcare.gov plan search and subsidy data, and plan-quoter handles ICHRA, Medicare, and ACA quoting, both pulled directly into a conversation instead of you re-entering the same client details across separate browser tabs for each source (Ambrose docs, Spokes, verified live). That’s real time back on the part of the job that’s genuinely repetitive: re-keying the same income and household numbers into three different quoting tools for the same client.
Neither spoke is documented as independently verifying provider network accuracy, and it’s worth saying plainly: no vendor’s tool does that yet, including CMS’s own new system, which explicitly checks format and freshness rather than truth. If a capability like that ships and gets confirmed in Ambrose’s docs, that’s worth its own article — but naming it here before it’s documented would be exactly the kind of overclaim this site tries not to make. What Ambrose gets you today is faster, cleaner plan and subsidy data during the parts of the conversation that don’t require a phone call — and the phone-call step above is still yours to do, by hand, every time.
Keep client-specific verification notes out of general AI tools
If you're logging provider verification calls — client name, specific plan, specific provider — that's information tied to a real person's health coverage. A general-purpose AI tool with no Business Associate Agreement with your agency isn't the place to store or summarize it. Ambrose's PHI Rail is documented as aliasing identifiers before any non-BAA destination sees them, which is built for exactly this kind of note-taking (Ambrose docs, What is Ambrose). With any tool that isn't covered by a BAA, keep verification logs generic or on paper.
What you get by joining
One Ambrose seat, including marketplace-finder and plan-quoter, comes with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, founding rate locked in while the membership stays active. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, 30+ hours of recorded training, Meta Ads and Google Ads training built for this industry specifically, pre-built AI templates and bot deployments, and a free annual in-person member workshop — plus an explicit no-recruiting rule, so a real question about a client’s provider network doesn’t turn into a downline pitch.
The manual method above works whether you join or not
Every step in this article — pulling both directories, the three-question phone script, the documentation habit — is something you can do for free, today, with a phone and the plan's website. Ambrose and the community make the plan-comparison side of the job faster; they don't replace the phone call, and neither does anything else on the market right now.
The close
Provider directories have had a documented accuracy problem since at least CMS’s first review round a decade ago, and the CY2027 changes are a real structural fix to how that data gets submitted — not a guarantee that what’s submitted is true, by CMS’s own admission. Until an independent verification layer exists, the three-question phone call above is still the only way to actually know. If you’d rather have the plan-comparison side of this handled while you focus on the calls that matter, one Ambrose seat comes with a Tech Savvy membership, and the weekly build-with-you calls are where agents actually get it set up: https://techsavvyinsurance.com/.
Compliance note
This article covers plan-comparison and provider-verification workflow, not marketing copy — but if you’re a Third-Party Marketing Organization under 42 CFR 422.2260, remember your standard TPMO disclaimer and CMS marketing-rule obligations still apply to everything else you publish and say to Medicare beneficiaries, separate from anything discussed here. If you use an AI tool to help draft verification logs, client summaries, or any Medicare-related communication, the NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers expects written policies, human oversight, and documentation, and states that “decisions or actions made or supported by AI must comply with all applicable insurance laws and regulations” (NAIC, Insurance Topics: Artificial Intelligence). Ambrose is HIPAA-aware by default, not HIPAA certified — no software platform can be “HIPAA certified,” and any vendor claiming otherwise is worth a second look.
Before you rely on any figure in this article
Tech Savvy Insurance is a training and software community, not an insurance company, agency, or law firm, and does not provide insurance, legal, tax, or compliance advice. You are responsible for your own licensure and for complying with all applicable CMS, HIPAA, state, and carrier regulations. Regulations and enforcement priorities can change — confirm current requirements directly with CMS, your carrier's marketing compliance team, or qualified legal counsel before relying on any figure here. AI-generated outputs may contain errors — always verify. Results may vary.
Frequently asked questions
Sources
- Federal Register — Medicare and Medicaid Programs; CY 2026 Policy and Technical Changes... Finalization of Format Provider Directories for Medicare Plan Finder Second Final Rule (CMS-4208-F2), September 19, 2025 — federalregister.gov
- CMS — Updates to the Contract Year 2026 Medicare Plan Finder and Medicare.gov (HPMS memo, August 25, 2025) — cms.gov
- CMS — DRAFT Technical Implementation Guide for Supplying MA Provider Directory Data for Use in MPF, November 7, 2025 — cms.gov
- HHS Office of Inspector General — Many Medicare Advantage and Medicaid Managed Care Plans Have Limited Behavioral Health Provider Networks and Inactive Providers (OEI-02-23-00540), October 2025 — oig.hhs.gov
- CMS — Online Provider Directory Review Report, Round 2 (2016-2017 data, published 2018) — cms.gov
- NAIC — Insurance Topics: Artificial Intelligence (Model Bulletin) — content.naic.org
- Ambrose docs — Spokes — app.hiambrose.com
- Ambrose docs — What is Ambrose — app.hiambrose.com
Ready to put this into practice?
Join a private community of Health & Life insurance professionals using AI, Meta Ads, and automation to grow — without draining their bank account.
Join Tech Savvy — $97/month