CMS Provider Directory Requirements 2027: Medicare Advantage, Medicaid & CHIP

Q: What must Medicaid and CHIP provider directories include?

Under Section 5123 of the Consolidated Appropriations Act, 2023: each provider's name, specialty, addresses, phone numbers, cultural and linguistic capabilities, new-patient acceptance, disability accommodations, website and telehealth availability.

Last updated: October 16, 2026‍

‍

Short answer: For plan year 2027, Medicare Advantage (MA) organizations must make their provider directory data available to CMS for Medicare Plan Finder, update it within 30 days of learning of a change, and attest to its accuracy at least once a year (42 CFR 422.111(m)). Medicaid and CHIP directories have been held to Section 5123 of the Consolidated Appropriations Act, 2023 since July 1, 2025: more required data fields, at least quarterly updates, and a public HL7 FHIR API.

‍

At a Glance

Medicare Advantage

Rule: CY 2026 final rule (CMS-4208-F2), new 42 CFR 422.111(m)
Applies to: plan years beginning on or after January 1, 2026
Where data appears: Medicare Plan Finder. For plan year 2027, plan-submitted data replaced the third-party network data used for plan year 2026 (CMS lists an October 9, 2026 launch).
Format: machine-readable JSON or FHIR-based JSON, posted at a contract-level URL CMS downloads daily
Updates: within 30 days of becoming aware of a change
Attestation: at least annually, through HPMS

Medicaid and CHIP

Rule: Section 5123, Consolidated Appropriations Act, 2023 (CMS State Health Official letter #24-003)
In effect: July 1, 2025
Applies to: fee-for-service, PCCM, managed care plans (MCOs, PIHPs, PAHPs) and CHIP
Format: public, searchable website plus a public HL7 FHIR R4.0.1 API
Updates: at least quarterly; managed care and API updates within 30 days of receiving new information

‍

Medicare Advantage: Provider Directories on Medicare Plan Finder

CMS finalized the requirement in the Contract Year 2026 final rule, published September 19, 2025 and effective November 17, 2025. It adds paragraph (m) to 42 CFR 422.111. Plan Finder first showed MA provider networks for plan year 2026, using third-party data. For plan year 2027, CMS replaced that with the directory data each MA organization submits and CMS validates.

‍

Here’s how the two years compare:

Medicare Plan Finder provider data: plan year 2026 vs. 2027
	Plan year 2026	Plan year 2027
Data source	A third-party vendor (not named by CMS)	Directory files each MA organization posts at a contract-level URL
Format	Not specified by CMS	Machine-readable JSON or FHIR-based JSON (FHIR-based only no earlier than contract year 2028)
How CMS gets updates	Not specified by CMS	Downloads and validates files daily, around 4 a.m. ET
Plan's update duty	Not applied to the vendor data	Within 30 days of becoming aware of a change (42 CFR 422.111(m))
Attestation	None for this data	An officer of the MA organization attests to accuracy at least annually, in HPMS
When data is wrong	CMS created a special enrollment period for people misled by inaccurate network data	Records that fail Level 2 validation are hidden from Plan Finder until fixed; the rest of the file still shows

‍

For plan years beginning on or after January 1, 2026, MA organizations must:

Make their provider directory information available to CMS for publication online, in the format, manner and timing CMS sets
Update that information within 30 days of the date the organization becomes aware of a change
Attest at least annually that the information is accurate

CMS did not finalize a proposal to also attest that directory data matches network adequacy submissions. The attestation covers accuracy.

‍

Timeline

September 19, 2025: Final rule published
November 7, 2025: Draft technical implementation guide released for comment
November 17, 2025: Rule effective
May 1, 2026: Technical implementation guide published
July 10, 2026: Deadline to enter MPF Provider Directory URLs and FHIR API endpoints in HPMS
September 18, 2026: Target for production-ready data and HPMS attestation (CMS called it "a target checkpoint, not a cutoff")
October 1–9, 2026: CMS scheduled plan-submitted data for October 1 and lists October 9 as the launch of the switch from third-party data on the plan year 2027 Medicare Plan Finder
October 15 – December 7, 2026: Annual Enrollment Period, when beneficiaries compare networks on Plan Finder
Contract year 2028 at the earliest: CMS's planned move to FHIR-based JSON only

‍

How CMS Collects and Checks the Data

Each MA organization posts its directory files at a contract-level MPF Provider Directory URL, with an index file listing every JSON file. CMS downloads and validates the data daily, around 4:00 a.m. ET. Validation findings come in three levels:

Level 1 (fatal): the dataset can't be processed and must be fixed right away
Level 2 (record skip): the specific record is not shown on Plan Finder until the issue is resolved; the rest of the file still displays
Level 3 (informational): no action needed unless it reveals a real problem

CMS geocodes addresses, and records it can't place are flagged at Level 2. It uses NPPES to check NPI, name and provider type. Pharmacies are submitted separately, telehealth-only providers can't be reported yet, and group-level NPIs should not be included under the current specifications.

‍

The attestation is a point-in-time snapshot. CMS has said it reflects "reasonable, good-faith efforts to maintain accurate provider directory data," that open Level 2 errors don't block attestation, and that plans can keep updating data afterward.

‍

What MA Plans Should Do Now

Clear Level 2 errors first. Every skipped record is a provider that members shopping during Annual Enrollment can't see.
Fix addresses that won't geocode. CMS flags records it can’t geocode as Level 2, so they’re hidden too. Check suite numbers and address formatting first.
Prove your 30-day update process. Keep a dated record of when you learned of each change and when you posted the update.
Reconcile your sources. Plan Finder data, your member-facing directory and your FHIR Provider Directory API should show the same network.
Name the attestation owner. Decide who signs and what evidence they review before signing.
Plan for FHIR-based JSON. If you submit machine-readable JSON today, schedule the move before contract year 2028.

‍

Medicaid and CHIP: Section 5123 Requirements

Section 5123 of the Consolidated Appropriations Act, 2023 took effect July 1, 2025. CMS explained it to states in State Health Official letter #24-003 (July 16, 2024).

‍

Who It Applies To

Medicaid fee-for-service and primary care case management (PCCM)
Medicaid managed care: MCOs, PIHPs, PAHPs and, where appropriate, PCCM entities
CHIP fee-for-service and CHIP managed care

Medicare Advantage and commercial plans are not covered by Section 5123. Medicare Advantage follows 42 CFR 422.111(m) above, and commercial and marketplace plans follow separate federal and state rules, including the No Surprises Act.

‍

Required Data for Each Provider

Name, specialty, service address(es) and phone number(s)
Cultural and linguistic capabilities, including American Sign Language offered by the provider or through a skilled medical interpreter
Whether the provider accepts new Medicaid and new CHIP patients
Accommodations for people with physical disabilities
Website, if applicable
Whether covered services are offered by telehealth

Directories must cover physicians, hospitals, pharmacies, mental health and substance use disorder providers, and long-term services and supports providers as appropriate.

‍

How Often Directories Must Be Updated

Fee-for-service and PCCM: at least quarterly (previously annual)
Managed care electronic directories: at least quarterly, and no later than 30 days after the plan receives new provider information
Managed care paper directories: monthly without a mobile-enabled electronic directory, quarterly with one

‍

Public Website and FHIR API

The directory must be public and searchable on a website. Medicaid and CHIP programs must also maintain a publicly accessible HL7 FHIR Release 4.0.1 Provider Directory API, updated within 30 calendar days of receiving new information.

‍

Funding and Consequences for States

States can request 90/10 enhanced federal funding for directory system design and development through an advance planning document (APD), and 75% for qualifying operations.
If CMS finds a state's fee-for-service directory out of compliance, it requests a corrective action plan. If the plan isn't met, federal funding for the non-compliant system operations drops from 75% to 50%.

‍

How Leap Orbit Helps

Leap Orbit builds provider directory infrastructure for Medicare Advantage and Medicaid plans:

Convergent brings provider, location and network data from your source systems into one governed record.
CareLoaDr ingests rosters and checks changes against sources such as NPPES and state licensing boards, flagging low-confidence updates for review.
CareFinDr is the member-facing directory and public HL7 FHIR R4.0.1 Provider Directory API, with required fields like accessibility, languages, telehealth and new-patient status searchable by default.

Champion Health Plan runs its Medicare Advantage C-SNP and MAPD directory on CareFinDr, and Alliance Health, a North Carolina Medicaid Tailored Plan, uses it for natural language provider search.

‍

FAQ

What are the CMS provider directory requirements for Medicare Advantage?

Under 42 CFR 422.111(m), MA organizations must make provider directory data available to CMS for Medicare Plan Finder, update it within 30 days of learning of a change, and attest to its accuracy at least annually.

When did Medicare Advantage provider directories appear on Medicare Plan Finder?

Plan Finder first showed MA provider networks in October 2025 for plan year 2026, using third-party data. For plan year 2027, CMS replaced it with directory data each MA organization submits and CMS validates, with a listed launch of October 9, 2026, ahead of the October 15 – December 7 Open Enrollment period.

What file format does CMS accept for Medicare Plan Finder?

For contract year 2027, CMS accepts machine-readable JSON or FHIR-based JSON posted at a contract-level URL. CMS plans to require FHIR-based JSON no earlier than contract year 2028.

What happens if Plan Finder validation fails?

A fatal (Level 1) error stops the dataset from processing. A Level 2 error hides that provider record from Plan Finder until it's fixed, while the rest of the directory still displays.

What must Medicaid and CHIP provider directories include?

Under Section 5123, each provider's name, specialty, addresses, phone numbers, cultural and linguistic capabilities, new-patient acceptance, disability accommodations, website and telehealth availability.

Do Medicaid and CHIP directories need a FHIR API?

Yes. Medicaid and CHIP programs must maintain a publicly accessible HL7 FHIR Release 4.0.1 Provider Directory API, updated within 30 calendar days of receiving new information.

‍

Talk to Us About Plan Finder and Directory Compliance

If you're working through Plan Finder validation errors, your 30-day update process or Section 5123 data gaps, our team can review where you stand.

👉 Book a directory compliance review

‍

Sources

‍

Back to the Blog

CMS Provider Directory Requirements for 2027: Medicare Advantage, Medicaid and CHIP

Team Member