Medicaid MCO Network Adequacy and the State's Role

When a Medicaid managed care plan says its network is full, it is making a claim about its compliance with standards the state wrote, not standards the plan chose. Federal rules put the state in charge of setting network adequacy standards, holding plans to them and reporting to CMS. That structure matters to a provider who has been turned away, because it tells you who has the power to ask the plan to do more, and what evidence that party already has to collect.

Who sets Medicaid network standards?

The state. "A State that contracts with an MCO, PIHP or PAHP to deliver Medicaid services must develop and enforce network adequacy standards consistent with this section" (42 CFR 438.68(a)). At a minimum the state must set a quantitative standard, other than appointment wait times, for adult and pediatric primary care, OB/GYN, adult and pediatric mental health and substance use disorder services, specialists the state designates, hospitals, pharmacy and several other categories, plus long-term services and supports where covered (438.68(b)). States may vary the standard for the same provider type by geography (438.68(b)(3)).

In building those standards, a state must consider, among other things, "The numbers of network providers who are not accepting new Medicaid patients" and "The geographic location of network providers and Medicaid enrollees, considering distance, travel time, the means of transportation ordinarily used by Medicaid enrollees" (438.68(c)(1)(v) and (vi)). A directory full of clinicians who do not take new Medicaid patients is exactly what the rule tells states to look past.

States must publish the standards on their Medicaid website (438.68(g)). That is the first document to pull before writing any letter about adequacy.

What do plans owe their members when the network falls short?

The state must ensure, through its contracts, that each plan "Maintains and monitors a network of appropriate providers that is supported by written agreements and is sufficient to provide adequate access to all services covered under the contract for all enrollees" (42 CFR 438.206(b)(1)). And when the network cannot deliver: "If the provider network is unable to provide necessary services, covered under the contract, to a particular enrollee, the MCO, PIHP, or PAHP must adequately and timely cover these services out of network for the enrollee, for as long as the MCO, PIHP, or PAHP's provider network is unable to provide them" (438.206(b)(4)). The plan must make the out-of-network provider coordinate on payment and keep the member's cost no higher than in network (438.206(b)(5)).

For a provider, 438.206(b)(4) is the federal basis for a per-patient agreement while a contracting dispute runs. See single-case agreements.

How does the state check a plan's network?

Through documentation the plan must file. Each plan gives the state "assurances" and supporting documentation that it "has the capacity to serve the expected enrollment in its service area" (42 CFR 438.207(a)), including that it "Maintains a network of providers that is sufficient in number, mix, and geographic distribution" (438.207(b)(2)). Plans must file this when they sign the contract, every year, and whenever there is "a significant change" in services, service area, the "composition of or payments to its provider network," or enrolled populations (438.207(c)).

The state then reviews it and submits an assurance of compliance to CMS, supported by an analysis of each plan's network (438.207(d)). That report must be posted on the state's website within 30 calendar days of submission to CMS, a requirement that applies starting with rating periods beginning on or after July 9, 2025 (438.207(d)(3) and (g)). Those posted analyses are public evidence a provider can quote.

When do the 2024 rule changes take effect?

The 2024 managed care rule phased in several pieces, each tied to the first rating period beginning on or after a date (438.68(h); 438.207(g)):

• July 9, 2026: an exception to a network standard must include "consideration of the payment rates offered" by the plan to the provider type (438.68(d)(1)(iii)). Exceptions must also be based on "the number of providers in that specialty practicing in the" plan's service area (438.68(d)(1)(ii)).
• July 9, 2027: appointment wait time standards: outpatient mental health and substance use disorder services within 10 business days, primary care and OB/GYN within 15 business days, with compliance measured as at least 90 percent appointment availability (438.68(e)). Our post on Medicaid's new wait-time standards covers these.
• July 9, 2028: annual independent secret shopper surveys of directory accuracy, including "Whether the provider is accepting new enrollees," and of wait times (438.68(f)), and remedy plans (438.207(f)).

Why do remedy plans matter to a rejected provider?

Once 438.207(f) applies, when the state, a plan or CMS identifies an area where access "could be improved," the state must submit a remedy plan to CMS within 90 calendar days of becoming aware of the issue and address it within 12 months. The rule lists actions a remedy plan may include: "increasing payment rates to providers, improving outreach and problem resolution to providers, reducing barriers to provider credentialing and contracting, providing for improved or expanded use of telehealth." Federal rules now name credentialing and contracting barriers as a fix for access problems. A provider who documents being turned away from a short network is supplying the kind of fact a remedy plan responds to.

What evidence speaks to a state's standards?

• The state's published standard for your provider type and county or region.
• The plan's directory for your area, and a call log showing which listed providers are reachable, in network and accepting new Medicaid patients. Directory accuracy has its own rules; see provider directory accuracy.
• Appointment wait times members are actually offered, and travel times from the communities you serve.
• The plan's written reason for declining you, which 42 CFR 438.12(a)(1) requires.
• Patient demand, shown without protected health information unless patients have authorized its use.

Some states already test plans directly. Florida's agency must "conduct, or contract for, systematic and continuous testing of the provider network databases maintained by each plan to confirm accuracy, confirm that behavioral health providers are accepting enrollees, and confirm that enrollees have access to behavioral health services" (Fla. Stat. 409.967(2)(c)1.). See documenting an access gap for the method.

Where should the evidence go?

First to the plan, with a request to reconsider. If that fails, to the state Medicaid agency's managed care or provider relations unit, framed as a question of the plan's compliance with the state's published standards, not as "they will not contract with me." Agencies follow their own intake rules, so read your state's page first; our state network access laws index lists them where verified.

How we help

We are not a law firm and we do not represent providers; we research, prepare and organize. A Network Rejection Review ($249, credited toward a dispute) finds your state's published standard and compares it to the plan's stated reason. A Payer Network Dispute ($799 per payer) builds the directory audit, the access evidence, the plan letter and a state agency complaint draft. You sign and send them, and we track the responses. If the plan offers a contract or a single-case agreement, the fees are flat: $1,500 per contract or credentialing win, $350 per single-case agreement. Questions about your legal rights go to a healthcare attorney.