CMS Owns the Medicare Advantage Provider Directory Now. Your CEO Owns the Data.
A rule finalized in 2025 makes CMS the single publisher of Medicare Advantage provider directories starting October 1, 2026. It also makes a named CEO, CFO, or COO personally attest the underlying data is accurate, without CMS ever checking whether it actually is.
Key takeaways
- CMS-4208-F2, finalized September 18, 2025, requires Medicare Advantage organizations to submit provider and facility directory data directly to CMS for daily-crawled publication on Medicare Plan Finder, replacing plan-hosted directories as the primary federal comparison source.
- The contract year 2027 attestation, due in HPMS by September 1, 2026, must be signed personally by the CEO, CFO, or COO, certifying the submitted data is accurate, complete, and truthful.
- CMS’s own technical implementation guide states that its daily validation checks format and thirty-day freshness, not accuracy, and that Medicare Advantage provider directory data accuracy is the responsibility of the plan.
- Production release of the redesigned Medicare Plan Finder is set for October 1, 2026, fourteen days before the October 15 Annual Enrollment Period opens; CMS can suppress a plan’s listing for a failed attestation, fatal validation errors, or data-quality issues above an unpublished threshold.
- The requirement follows HHS-OIG’s June 2026 finding that Medicaid managed care network files and member-facing directories are frequently unreliable because they sit on separate, unreconciled systems, a structurally similar problem CMS is now addressing differently on the Medicare Advantage side.
A federal directory pipeline, phased in since 2025
CMS published CMS-4208-F2 on September 18, 2025, finalizing the new paragraph at Section 422.111(m). The rule covers Medicare Advantage organizations offering individual, non-employer-only plans: local coordinated care plans, regional preferred provider organizations, network-based Medical Savings Account plans, and network-based Private Fee-for-Service plans. Each must make its provider and facility directory data available to CMS and HHS for publication on Medicare Plan Finder, the comparison tool CMS operates at medicare.gov. The requirement is administered through CMS’s Health Plan Management System (HPMS), the agency’s plan-management portal, and jointly enforced with the U.S. Department of Health and Human Services (HHS), CMS’s parent agency.
CMS is phasing in the requirement. For contract year 2026, plans used an interim solution: supplying data through a CMS-contracted vendor or linking to their own directory URL in HPMS. Starting with contract year 2027, plans must submit through one of two channels. The options are machine-readable JSON files modeled on the Affordable Care Act Marketplace format, or JSON APIs built on Fast Healthcare Interoperability Resources (FHIR), the HL7 data-exchange standard, following the Da Vinci PDex Plan-Net Implementation Guide.
CMS crawls each plan’s designated API URL every day to pull the data into Medicare Plan Finder, per CMS’s own Technical Implementation Guide for Supplying Medicare Advantage (MA) Provider Directory Data. The contract year 2027 attestation, signed by an authorized CEO, CFO, or COO, was due September 1, 2026, following a plan testing period that ran May 4 through August 31, 2026.
On September 1, 2026, a CEO, CFO, or COO at every Medicare Advantage organization in the country was supposed to sign a single line in a federal system certifying that their Medicare Advantage provider directory is accurate, complete, and truthful. Most did. Almost none independently verified it. CMS did not ask them to.
Deadline for every Medicare Advantage organization to complete its contract year 2027 provider directory attestation in HPMS, signed personally by the CEO, CFO, or COO.
CMS checks the file. It does not check the facts in it.
“The process outlined above will not validate the accuracy of the provider directory information submitted by MA organizations. Data accuracy is the responsibility of the MA plan.”
CMS Technical Implementation Guide for Supplying Medicare Advantage (MA) Provider Directory Data for Use in Medicare Plan Finder, November 7, 2025. CMS’s daily crawl validates file format and whether the record was updated within thirty days, nothing more.
Three phases, one crawler, one signature
- Phase 1, contract year 2026: interim solution; plans supply data through a CMS-contracted vendor or link to their own directory URL in HPMS.
- Phase 2, contract year 2027: plans submit machine-readable JSON files or FHIR-based JSON APIs built to the HL7 Da Vinci PDex Plan-Net Implementation Guide; CMS crawls the designated URL every day.
- Phase 3, National Provider Directory: CMS is building a FHIR-based national directory, announced July 2025, intended to eventually feed Medicare Plan Finder directly.
- Testing period: May 4 through August 31, 2026.
- Attestation deadline: September 1, 2026, signed by the CEO, CFO, or COO, certifying the data is accurate, complete, and truthful.
- Suppression authority: CMS can remove a plan’s directory from Medicare Plan Finder for a missed attestation, fatal validation errors, or data-quality issues above a threshold CMS has not published.
A federal channel, a personal signature, and an unclosed gap
The Medicare Advantage provider directory attestation is not a formality. CMS requires a named executive personally to certify, in HPMS, that submitted directory data is accurate, complete, and truthful to the best of the organization’s knowledge at the moment of signing. That sits alongside CMS’s separate authority to suppress a plan’s Medicare Plan Finder listing during Annual Enrollment for a missed attestation, a validation failure, or data-quality problems above a threshold CMS has not yet published.
A suppressed listing during the six-week window when most Medicare beneficiaries compare plans is a direct enrollment consequence, not merely a compliance finding. Yet CMS’s technical guide is explicit that the daily crawl checks whether a file is technically well-formed and updated within thirty days, not whether the underlying provider and facility information is actually correct. The rule creates a federal, centralized publication channel and a personal certification requirement, without CMS verifying it. Closing that gap is now a compliance, network, and data leadership task, because CMS will not close it.
The data behind the attestation rarely originates inside the compliance department. Provider and facility records typically flow from credentialing systems, contracted network management functions, and, in many organizations, first-tier, downstream, and related entities that manage all or part of network operations. Delegation does not change who signs. The CEO, CFO, or COO attests to data assembled several steps upstream, often by a vendor or delegate whose own data quality the plan may not have independently verified before the deadline.
CMS solved the part of the provider directory problem it could control, and put someone else’s name on the part it couldn’t.
The attestation touches more than compliance
Compliance
Owns tracking the HPMS attestation and CMS’s daily validation results as a standing, not annual, compliance artifact.
Delegation Oversight / Network Management
Provider and facility data usually originates with FDRs and vendors; their accuracy is now under daily federal observation.
IT / Data
The JSON or FHIR feed becomes a production system with a thirty-day freshness clock, not a static file.
Legal
A named executive’s personal representation now carries the accuracy claim CMS itself declines to verify.
Executive leadership
The CEO, CFO, or COO signs on data assembled several steps upstream, often without independent verification.
Member experience
A suppressed listing during Annual Enrollment removes the plan’s network from beneficiary comparison at medicare.gov.
Turning one signature into a documented process
Delegation does not change who signs the attestation. Closing the gap between CMS’s technical validation and the accuracy claim it requires means giving the signing executive an internal evidence chain, not asking them to sign on faith.
| Function | Required response | Evidence to retain |
|---|---|---|
| Compliance | Confirm the CY2027 HPMS attestation was completed by an authorized CEO, CFO, or COO by September 1, 2026, and track CMS validation results going forward. | Signed attestation record, HPMS confirmation, validation and suppression history. |
| Delegation Oversight / Network Management | Reconcile FDR- and vendor-sourced provider and facility data against the plan’s internal source-of-truth before each attestation cycle, not after. | Reconciliation logs, FDR data-quality reports, credentialing verification records. |
| IT / Data | Build and maintain the machine-readable JSON or FHIR-based API feed CMS crawls daily, meet the thirty-day update requirement, and monitor HPMS validation findings. | System change logs, API uptime and validation reports, update timestamps. |
| Legal | Advise the CEO, CFO, and COO on the personal representation made in each annual attestation and the evidentiary standard behind it. | Legal review memos, attestation sign-off documentation. |
| Executive leadership (CEO / CFO / COO) | Require a documented sub-certification from Compliance, Network Management, and IT before signing the annual attestation. | Sub-certification memos, executive attestation record. |
Within 7 days
- Confirm, in writing, that the CY2027 HPMS provider directory attestation was completed by September 1, 2026, identify the signing executive, and locate the internal evidence supporting that signature.
- Check current CMS validation results for the plan’s machine-readable JSON or FHIR API feed in HPMS, ahead of the October 1 production release.
Within 30 days
- Reconcile the data in the CMS-crawled feed against the plan’s internal provider and facility source-of-truth system, with particular attention to any FDR- or vendor-managed network segments.
- Confirm the thirty-day update process is operating in practice, not just on paper, by testing how quickly a known provider change reaches the published feed.
Within 60 to 90 days
- Build a standing sub-certification process in which Network Management, Credentialing, and IT confirm data accuracy to the CEO, CFO, or COO in writing before each annual HPMS attestation.
- Extend the same reconciliation discipline to any Medicaid managed care provider directories the organization maintains, given HHS-OIG’s June 2026 findings on the same underlying failure mode.
PCOOB Weekly analysis
PCOOB Weekly’s assessment is that CMS has solved the part of the provider directory problem it can control, the publication channel. It has shifted responsibility for the part it cannot easily control, data accuracy, onto a named executive signature. That is a coherent regulatory strategy. Centralize the data pipeline, then use personal attestation and enrollment-season suppression as the enforcement mechanism, rather than building a federal accuracy-verification function CMS itself would have to staff and defend.
Read against HHS-OIG’s June 2026 findings on Medicaid managed care, it is also a study in contrast. On the Medicaid side, OIG diagnosed the root cause as two unreconciled systems, state-facing network files and member-facing directories, maintained separately with no reconciliation requirement, and recommended closing that gap. On the Medicare Advantage side, CMS did not primarily mandate reconciliation between a plan’s internal systems and what it publishes. It built a single federal target to submit to instead, and made executive attestation the proof that reconciliation happened, rather than requiring evidence of it as part of the process.
This is an inference, not a confirmed CMS statement of intent. But the practical effect is that a plan could pass CMS’s daily validation and have its CEO sign a truthful attestation. Delegate-sourced data can still contain the kind of errors OIG found where directory data is assembled without independent reconciliation. A signature workflow and a JSON feed satisfy CMS’s publication requirement. They do not, by themselves, fix the data governance failure mode that produced the Medicaid findings.
What to ask before the next HPMS sign-off
- Did our CEO, CFO, or COO actually complete the CY2027 HPMS provider directory attestation by September 1, 2026, and do we have a documented record of it?
- What evidence supported that attestation, and was it generated independently of the vendor or FDR that assembled our network file?
- Is our machine-readable JSON or FHIR-based provider directory feed passing CMS’s daily crawl validation right now, ahead of the October 1 production release?
- What would trigger suppression from Medicare Plan Finder during the October 15 Annual Enrollment Period, and do we have a same-day escalation path if it happens?
- If we also operate Medicaid managed care lines, are we applying the same directory reconciliation discipline there that OIG found missing in its June 2026 evaluations?
- Who in our organization is accountable for the underlying data accuracy, as distinct from who is accountable for the technical validation CMS performs?
Sources
- CMS, “Technical Implementation Guide for Supplying Medicare Advantage (MA) Provider Directory Data for Use in Medicare Plan Finder (MPF),” November 7, 2025. https://www.cms.gov/files/document/mpf-ma-provider-directory-technical-guide-11072025-final-draft.pdf
- Federal Register, “Medicare and Medicaid Programs; Contract Year 2026 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and PACE—Finalization of Format Provider Directories for Medicare Plan Finder (CMS-4208-F2),” September 19, 2025. https://www.federalregister.gov/documents/2025/09/19/2025-18236/medicare-and-medicaid-programs-contract-year-2026-policy-and-technical-changes-to-the-medicare
- HHS Office of Inspector General, “Inaccurate Medicaid Managed Care Network Lists May Compromise State Oversight of Access to Maternal Health Care (OEI-05-24-00090),” 2026. https://oig.hhs.gov/reports/all/2026/inaccurate-medicaid-managed-care-network-lists-may-compromise-state-oversight-of-access-to-maternal-health-care/
- HHS Office of Inspector General, “Inaccurate Medicaid Managed Care Provider Directories May Limit Enrollees’ Access to Maternal Health Care (OEI-05-24-00091),” 2026. https://oig.hhs.gov/reports/all/2026/inaccurate-medicaid-managed-care-provider-directories-may-limit-enrollees-access-to-maternal-health-care/
- CMS, “Contract Year 2026 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and PACE Final Rule Fact Sheet (CMS-4208-F),” April 4, 2025. https://www.cms.gov/newsroom/fact-sheets/contract-year-2026-policy-and-technical-changes-medicare-advantage-program-medicare-prescription-final
Quick answers, grounded in the sources above
What is CMS-4208-F2?
CMS-4208-F2 is a final rule CMS published September 18, 2025, codified at 42 CFR Section 422.111(m). It requires Medicare Advantage organizations to submit provider and facility directory data directly to CMS for publication on Medicare Plan Finder, update that data within thirty days of any known change, and attest annually to its accuracy. The first full production release of the redesigned Medicare Plan Finder under this rule is set for October 1, 2026.
Who has to sign the Medicare Advantage provider directory attestation?
The attestation must be completed electronically in HPMS by an authorized official of the Medicare Advantage organization, specifically the Chief Executive Officer, Chief Financial Officer, or Chief Operating Officer. The signatory certifies the submitted provider directory data is accurate, complete, and truthful to the best of the organization’s knowledge at the time of signing. The contract year 2027 attestation deadline was September 1, 2026.
Does CMS verify that Medicare Advantage provider directory data is accurate?
No. CMS’s own technical implementation guide states that its daily crawl validates whether a plan’s data file is technically well-formed and updated within thirty days, not whether the underlying provider and facility information is correct. CMS states plainly that data accuracy is the responsibility of the Medicare Advantage plan, which makes the CEO, CFO, or COO attestation the operative accuracy check in the process.
What happens if a Medicare Advantage plan misses the attestation or fails validation?
CMS can suppress a plan’s provider directory data from Medicare Plan Finder for a missed attestation, fatal validation errors in the submitted file, or data-quality issues that exceed a threshold CMS has not yet published. Suppression during the October 15 to December 7 Annual Enrollment Period means beneficiaries cannot see that plan’s network when comparing options on medicare.gov, a direct enrollment consequence rather than only a compliance finding.
How does this compare to Medicaid managed care provider directory oversight?
HHS-OIG found in June 2026 that Medicaid managed care network files and member-facing directories are often inaccurate because they are maintained on separate, unreconciled systems. CMS’s Medicare Advantage approach centralizes submission through a single federal channel it crawls daily, but relies on executive attestation rather than independent verification to establish accuracy, a different governance mechanism aimed at a similar underlying problem.