What Changed: From Operational Issue to Legal Exposure
For years, provider directory inaccuracies were addressed through periodic remediation: quarterly file reviews, annual cleanups, vendor attestations, and internal audits. These approaches were imperfect, but the risk of enforcement was limited and largely manageable.
That equilibrium no longer exists.
In October 2025, Health Net agreed to a $40 million settlement with the California Attorney General over misleading provider directories. The settlement also required approximately $28.5 million in compliance remediation — including audits, reporting obligations, and sustained process changes.
Shortly thereafter, Cigna agreed to pay $5.7 million to settle an ERISA class action alleging that inaccurate provider directories constituted a breach of fiduciary duty.
“Provider directory inaccuracies are no longer being treated as administrative errors. They are being treated as misrepresentations.”
Courts and regulators are not asking whether organizations intended to maintain accuracy. They are asking whether organizations can prove that accuracy is continuously maintained.
Why “Having Vendors” Is No Longer a Defense
Every organization involved in recent enforcement actions already had provider data vendors. They used reference databases, credentialing platforms, and directory management tools. And yet, ghost networks persisted. The failure was not the absence of tooling — it was fragmentation.
Provider data typically lives across:
- →Credentialing systems
- →Claims platforms
- →Contracting databases
- →Provider directories
- →Delegated rosters
- →Third-party reference sources
Each system updates on a different cadence, under different ownership, using different schemas. When one system changes, others lag. When conflicts arise, there is rarely a clearly enforced source of truth. The result is a paradox regulators now recognize: multiple “accurate” systems that disagree with each other.
Why Point-in-Time Accuracy Is No Longer Defensible
Federal law and regulatory guidance now expect provider directories to be verified at least every 90 days and updated within days — not months — when material changes occur. These expectations align poorly with legacy operating models built around quarterly or annual cleanup cycles.
A directory that is accurate on the day it is published, but allowed to drift for weeks or months afterward, no longer meets the standard regulators and courts are applying.
Requires 48-hour updates and 90-day verification cycles for provider directories.
Medicare Advantage directories now treated as public-facing infrastructure through Medicare Plan Finder — errors are externally verifiable.
Proposed legislation mandating 90-day verification as federal law — currently moving through Congress.
The Financial Reality Boards Now Face
Recent settlements changed the economics of provider data investment. Historically, organizations rationalized underinvestment by pointing to limited enforcement risk. That calculus has inverted.
Provider data accuracy now belongs in the same risk category as cybersecurity, financial controls, and regulatory reporting. Boards are increasingly expected to ask:
- ?What is our verification cadence?
- ?How do we reconcile provider identity across systems?
- ?Can we prove accuracy continuously, not periodically?
- ?What evidence would we produce in an audit or lawsuit?
Why Cleanup Will Never Be Enough
Many organizations respond to enforcement by doubling down on cleanup: more audits, more outreach, more manual verification. This approach misunderstands the problem.
Provider data is dynamic by nature. Providers are people — they move, change addresses, change phone numbers. Network participation changes. They retire. Static processes applied to dynamic, ephemeral data inevitably produce drift.
The Strategic Reframe: Provider Data as Infrastructure
Leading organizations are drawing a different conclusion. Rather than treating provider data as a compliance artifact or directory output, they are reframing it as core enterprise infrastructure — similar to identity, security, or financial controls.
The Window Is Narrowing
History offers a clear pattern. In cybersecurity, privacy, and financial reporting, organizations that invested early absorbed manageable costs. Late adopters implemented under consent decrees, audits, and public scrutiny — at far greater expense.
Provider data is entering the same phase. The window between early signals and mandatory compliance is closing. Organizations that act now retain control over scope, timing, and strategy. Those that wait will not.
What Comes Next
If you are responsible for compliance, risk, data, or enterprise strategy, the most important step is not selecting a tool — it is understanding your exposure.
- ?How fragmented is provider identity across your systems?
- ?How quickly does accuracy drift after verification?
- ?What evidence could you produce today if asked, “How do you know?”
Answering those questions honestly is where responsible action begins.