The CY 2027 Attestation Is Not a Routine Filing.
42 CFR 422.111(m) requires every Medicare Advantage organization to attest at least annually that the provider directory data it submits to CMS is accurate. CMS’s Technical Implementation Guide for the rule specifies who signs and how: the attestation must be completed electronically in HPMS, and only the CEO, CFO, or COO is authorized to sign. The language is fixed: “Accurate, complete, and truthful at the time of the attestation to the best information, knowledge, and belief of the MA organization.”
Unlike other Part 422 certification provisions, the Technical Guide names only those three officers and provides no pathway to delegate the signature to compliance staff or network operations. It is the signatory personally, under the standard of their own knowledge.
Today, most signatories would sign that attestation on faith. They would be relying on the confidence of their network operations team rather than on independent, documented evidence that what was submitted to CMS meets the technical specification, reconciles against federal reference data, and updates within the mandated 30-day cadence.
The NPD Submission Readiness Assessment closes that gap. It produces the evidence package your signatory needs to sign under the “best information, knowledge, and belief” standard, and the audit trail your compliance team needs when that attestation is later reviewed by regulators, plaintiffs’ firms, or state AGs.
Your compliance team drafts the attestation. Your signatory carries the liability.
The readiness evidence the signature rests on is the product.
This page walks through what the assessment delivers, how the 30-day engagement runs, and what your organization walks away with, beginning the moment the engagement kicks off and continuing long after September 1.
What Your Signatory Is Actually Signing
CMS-4208-F2 requires every Medicare Advantage organization to attest in HPMS at least annually that its provider directory data meets a specific, legally operative standard. CMS’s Technical Implementation Guide for the rule specifies who can sign: only the CEO, CFO, or COO, with no pathway to delegate. It is the signatory’s signature, under their own name, on their own standard of knowledge.
Four elements of that attestation define what “readiness” actually means before the signature is applied.
The CMS Validation Is Against the Submission Spec, Not Against the NPD
A frequent misreading of the new environment is that CMS will validate an MA plan’s directory against the National Provider Directory content. It will not. CMS will validate the plan’s submitted data against the CY 2027 Dual Option Solution technical specification, either a machine-readable MAPROVIDERS.JSON file or a FHIR-based JSON API conforming to the PDex Plan-Net Implementation Guide version 1.2.0 on HL7 FHIR R4, and against the 30-day update cadence. That conformance test is the gate. Reconciliation against the federally-published NPD reference dataset is a higher-quality readiness signal, but it is not what determines pass or fail.
That distinction matters for the reconciliation work itself. Per the AINPI third-party audit of the April 9, 2026 NPD release, the data is technically strong on some dimensions: 95.72% NPPES identity validity, 99.83% valid NUCC taxonomy on Practitioner.qualification, and clean Practitioner dedup across 7.44 million NPIs. It is materially weaker on others: 70.5% of Organization NPIs map to more than one Organization resource, and 98.7% of Organizations carry zero Endpoint references. Datagence’s own reconciliation of NPD records against PECOS enrollment status adds another layer: 60.25% of providers in the NPD are not in Medicare enrollment good standing. Reconciliation exceptions between a plan’s directory and the NPD may indicate plan-side errors, or they may indicate NPD-side artifacts. Distinguishing the two is the work.
The consequence of failing is concrete. When an MA organization fails attestation, produces fatal errors in JSON or FHIR validation, or exceeds CMS’s data quality thresholds, CMS suppresses the plan’s provider directory on Medicare Plan Finder. During Annual Election Period, that means beneficiaries shopping MPF do not see your providers at all. It is the most material competitive exposure in the CY 2027 calendar.
The Five Questions Every MA Plan Is Asking
Across every MA organization we have spoken with since the April 9 NPD release, the same five questions surface. Each one the assessment is built to answer with documented, defensible evidence.
What You Receive at the End of 30 Days
Each deliverable stands on its own if the engagement is paused. Together, they constitute the evidence package your signatory signs under, and the documentation your compliance team preserves as the audit trail behind the attestation event itself.
“The assessment should never be positioned as legal attestation. What it produces is the evidence the signatory relies on to attest, and the audit trail compliance relies on after.”
The signatory signs. The readiness evidence is what the signature rests on. Those are distinct documents with distinct legal status, and the assessment makes the distinction explicit in the deliverable package.
Optional Scope: Remediation Execution
For organizations that want the top 20% of highest-risk records remediated before the executive readout, rather than documented for internal execution, the assessment offers a capped $15,000 add-on that returns a cleaned, submission-ready dataset on the provider records most likely to trigger fatal errors in CMS validation.
The 30-Day Engagement
Four phases, each producing a deliverable that can stand on its own if the engagement pauses. Designed to fit inside the CMS Phase 2 plan testing window (May 4 to August 31, 2026) so that remediation begins before the testing period closes, not after.
The Evidence Package That Lives Beyond September 1
The attestation is not a private filing. Once signed, it becomes a document that plaintiffs’ firms, state attorneys general, and CMS auditors can reference in subsequent proceedings. A ghost network lawsuit filed in 2027 will ask the same question any compliance audit will ask: what evidence did the signatory rely on when attesting that the directory was “accurate, complete, and truthful”?
The readiness evidence produced in the assessment is designed to answer that question concretely. Three elements of the deliverable package are specifically structured for audit defense and post-attestation review.
The assessment does not eliminate audit or litigation exposure. No product does. What it does is move the evidentiary posture from “we believed it was accurate” to “we documented our diligence against the federal reference, the submission specification, and every data element CMS will validate against, on a dated timeline that preceded the attestation.”
How the Engagement Is Structured
Request a 30-Minute Scoping Call.
No sales pitch. A working conversation about your current directory posture, your FHIR readiness, and where your signatory’s exposure sits against the CMS-4208-F2 data elements. If the assessment fits your situation, we scope it on the call. If it does not, we say so.
42 CFR 422.111(m) (eCFR) · CMS-4208-F2 Medicare Advantage Provider Directory Final Rule (Federal Register, September 19, 2025) · CMS Draft Technical Implementation Guide for Supplying Medicare Advantage Provider Directory Data to CMS (November 7, 2025) · PDex Plan-Net Implementation Guide v1.2.0 on HL7 FHIR R4 · National Provider Directory Public Use Files (directory.cms.gov) · FHIR IQ / AINPI: Independent NPD Data Quality Audit, April 21, 2026 (ainpi.vercel.app) · Datagence NPD-PECOS Reconciliation Analysis, April 2026 · CMS OIG List of Excluded Individuals/Entities (LEIE) · SAM.gov Exclusions.