If you are a payer executive and you have been treating the April 9 NPD launch as the main event, I want to respectfully suggest otherwise.
The main event is Phase 2, and it starts in 2027
Here is what Phase 2 does. Starting in CY 2027, CMS will directly ingest data from each MA plan’s publicly accessible provider directory FHIR API and publish it to Medicare Plan Finder. That means the directory your plan submits is no longer a file sitting on your website that regulators review during audits. It is a live feed that CMS reads daily, surfaces to beneficiaries during AEP, and displays publicly for journalists, plaintiffs’ firms, and state regulators to see.
That is a structural change in how directory accuracy affects your plan.
The public scoring problem
Today, if your directory is 60% accurate, most of your members will never know. The errors surface quietly, one call at a time, and get managed by your member services team.
In 2027, if your directory is 60% accurate, Medicare Plan Finder will reflect that. Beneficiaries shopping during AEP will see it. A journalist writing about ghost networks will see it. A plaintiff’s firm evaluating class-action opportunities will see it. State insurance commissioners will see it.
The NPD does not fix bad data. It broadcasts it.
This is the line I keep coming back to in conversations with payer leaders, because it reframes what directory accuracy actually is. It stops being a compliance task. It becomes a public brand asset, visible in a way it never has been.
The enforcement is already scaling
This is not a theoretical future risk.
The appetite for federal enforcement is escalating broadly. Civil monetary penalties against MA and Part D sponsors in the first four months of 2025 exceeded the total for the prior four years, according to a Healthcare Dive analysis of CMS data. Under 42 CFR §422.760, CMS already has authority to impose up to $25,000 per MA enrollee, adjusted annually for inflation, for any plan deficiency that adversely affects members. The REAL Health Providers Act, signed into law on February 3, 2026, as part of the Consolidated Appropriations Act, 2026, codifies provider directory accuracy in federal statute for the first time, with compliance obligations taking effect plan year 2028 and public accuracy scores published on a CMS-maintained website beginning plan year 2029. In Medicaid managed care, the parallel pressure is real as well: independent secret-shopper surveys under 42 CFR §438.68 begin in 2028, and most MA parent organizations also operate Medicaid managed care lines.
State attorneys general are not waiting for Phase 2. The New York AG secured a $2.5 million settlement with EmblemHealth on February 19, 2026, the largest the office has obtained on provider directory accuracy. Six months earlier, the same office settled with MVP Health Plan, requiring a full directory overhaul, restitution to members affected since January 1, 2020, and a verification process that contacts every network provider every 90 days. In November 2025, a federal class action was filed against Blue Shield of California and Magellan Health, alleging that more than 75% of listed mental health providers are effectively unreachable. And in August 2025, Georgia’s insurance commissioner announced more than $20 million in fines against 22 insurers for mental health parity violations, including findings that overlap directly with directory accuracy.
When Phase 2 makes directory data publicly visible on the Medicare Plan Finder, this enforcement trajectory does not slow. It accelerates, because the evidence base for every future action becomes trivially easier to assemble.
What this means operationally
January 1, 2027, is the date on which Medicare Plan Finder begins publicly displaying MA directory data. The federal standard for that data is 85% accuracy, 30-day update cycles, and annual C-suite attestation. The first attestation, signed personally by a CEO, CFO, or COO in HPMS, is due September 1, 2026.
The plans that meet these deadlines well will be the plans that have already moved directory work from a quarterly reconciliation project to a continuous, automated operation. Plans that miss these deadlines will still be running the roster-plus-spreadsheet workflows the week before September 1.
The good news
The work is doable. The tools exist. The regulatory timeline is visible from here. Plans that start now have roughly four months of runway before the first attestation is due, and about nineteen months before Phase 2 publishing begins.
Next week, I will write specifically about what that September 1 attestation requires and why most plans are materially underprepared for it. I will also introduce our NPD Attestation Readiness Assessment, a structured way for payer leaders to evaluate their posture against what HPMS attestation actually demands.
If you would rather not wait for the next article, I am happy to walk through the assessment framework directly. Send a quick note to [email protected], and we’ll schedule 20–30 minutes to discuss.
If you want to dive deeper:
- Federal Register: CMS-4208-F2 Final Rule, 90 FR 45140, September 19, 2025
- Healthcare Dive: Civil Monetary Penalties Against MA/Part D Plans Rising (July 2025)
- 42 CFR §422.760: Determinations regarding the amount of civil money penalties imposed by CMS
- Congress.gov: H.R. 5281 / S. 3750, Requiring Enhanced and Accurate Lists of Health Providers (REAL) Act
- NY Attorney General: EmblemHealth $2.5M Ghost Network Settlement, February 19, 2026
- NY Attorney General: MVP Health Plan Ghost Network Settlement, August 26, 2025
- CMS: Part C and Part D Enforcement Actions
- Ideon: CMS Provider Directory Requirements Compliance Guide for 2026–2027