Provider Directory Accuracy Rules and Ghost Networks

A plan that says its panel is full is usually counting the providers in its directory. When those listings are wrong, the network is fuller on paper than in practice. Federal law sets verification and update deadlines for commercial, Medicare Advantage and Medicaid directories, and Medicaid adds independent secret shopper surveys. Here is how those rules turn a ghost network into evidence.

"Ghost network" is the informal name for a provider directory full of clinicians who are not really available: they retired, moved, stopped taking the plan, or are not accepting new patients. For a provider told that a panel is closed, ghost listings matter because they inflate the counts a plan uses to say it has enough providers. The rules on directory accuracy are therefore some of the most practical tools in a network dispute.

What does federal law require of commercial plan directories?

Since plan years beginning on or after January 1, 2022, group health plans and issuers of group or individual coverage must, under 42 U.S.C. 300gg-115(a):

Verify every 90 days. "Not less frequently than once every 90 days," verify and update directory information for each provider and facility in the directory database.
Remove what they cannot verify. Establish "a procedure for the removal" of providers whose information the plan has been unable to verify during a period the plan specifies.
Update fast. Update the database "within 2 business days" of receiving information from a provider.
Answer members quickly. Respond to a member who asks whether a provider is in network "as soon as practicable and in no case later than 1 business day," in writing, and keep the response for 2 years.

Directory information includes "the name, address, specialty, telephone number, and digital contact information" of each provider (300gg-115(a)(6)). The statute does not preempt state directory laws, which can be stricter (300gg-115(a)(7)).

The law also protects members. If a member relied on a directory or the plan's response showing a provider as in network, the plan cannot charge more than in-network cost-sharing (300gg-115(b)). Providers carry duties too: under 42 U.S.C. 300gg-139(a), providers must have business processes to give plans directory information when a network agreement begins or ends, when there are material changes, and at other appropriate times.

What about Medicare Advantage?

MA organizations must maintain a public provider directory API listing "the MA plan's network of contracted providers, including names, addresses, phone numbers, and specialties, updated no later than 30 calendar days after the MA organizations receives provider directory information or updates" (42 CFR 422.120(b)(1)).

And Medicaid managed care?

Medicaid directories carry the most detail. Under 42 CFR 438.10(h)(1), each plan's directory must show, for each network provider, the name and group affiliation, street address, telephone number, website, specialty, "whether the provider will accept new enrollees," languages, physical accessibility, and "whether the provider offers covered services via telehealth." An electronic directory must be updated "no later than 30 calendar days after" the plan receives updated information (438.10(h)(3)(ii)).

Medicaid is also adding independent checks. States must contract with an entity independent of the state and its plans to run annual secret shopper surveys testing directory accuracy for primary care, OB/GYN, outpatient mental health and substance use disorder providers, and one state-chosen type (438.68(f)(1)). The surveys must check "the active network status," street address, phone number and "whether the provider is accepting new enrollees." Errors go to the state within 3 business days of being found, and to the plan within 3 business days after that. Results must be posted on the state's website within 30 calendar days of submission to CMS (438.68(f)(5)). Under 438.68(h), the survey requirement applies from the first rating period beginning on or after four years after July 9, 2024.

Why do directory errors help a provider who was turned away?

Network adequacy is measured against listed providers. A state developing Medicaid standards must consider "the numbers of network providers who are not accepting new Medicaid patients" (438.68(c)(1)(v)). If a plan says your specialty is full in your county, and half its listings are unreachable or closed to new patients, the plan's own records do not support the claim. That is the core of an access-gap package; see documenting an access gap.

How do you run a directory audit that holds up?

Freeze the list. Save the directory search results, with the date, for your specialty and radius.
Call every listing using a written script: Is this provider at this address? Do they take this plan? Are they accepting new patients with this plan? What is the first available new-patient appointment?
Record outcomes in a table: wrong number, no answer after two tries, moved, not in network, not accepting, accepting with first date.
Summarize honestly. Report what share of listings were reachable, in network and accepting, and the median wait among those that were.
Do not pose as a patient or misstate who you are. Identify yourself as calling to check availability.

Then use it in a letter to the plan; see how to write a network adequacy letter. If a Medicaid plan is involved, published secret shopper results for your state, once available, can corroborate your findings.

Who else wants to know about ghost listings?

Regulators. State insurance departments, state Medicaid agencies, and for Medicare Advantage, CMS, all oversee directory accuracy in their programs. A complaint about inaccurate listings is a regulatory issue in its own right, which is often a better frame than asking a regulator to make a plan contract with you. See complaining to the state insurance department.

Is your own listing correct?

Check it, at every plan you participate with. An out-of-date listing for you can expose your patients to surprise costs, and providers that collect more than in-network cost-sharing from a patient who relied on a wrong directory listing must refund the excess with interest (300gg-139(b)).

How do we help?

We run the directory audit, compile the results, and prepare the dispute letter or regulator complaint draft. You review, sign and send it. We do not give legal advice or represent anyone. A Payer Network Dispute is $799 per payer, after a $249 Network Rejection Review that is credited toward it; see pricing. Legal questions, such as what a contract term means or whether to pursue a hearing, belong with a healthcare attorney.

Common questions

How often must insurers verify their provider directories?

Group health plans and issuers must verify and update directory information at least once every 90 days, and update the database within 2 business days of receiving information from a provider (42 U.S.C. 300gg-115(a)(2)).

What is a ghost network?

An informal term for a provider directory that lists clinicians who are not actually available to members, because they left, do not take the plan, or are not accepting new patients. It can make a network look adequate when access is poor.

When do Medicaid secret shopper directory surveys start?

Under 42 CFR 438.68(h), the survey requirement applies to the first rating period beginning on or after four years after July 9, 2024, which means rating periods starting on or after July 9, 2028.

Can I use a directory audit in a network dispute?

Yes. A documented audit showing listed providers are unreachable, out of network or not accepting new patients is strong evidence that a plan's network is not as full as its counts suggest.