As my colleague Leo Cuello has explained, the Centers for Medicare & Medicaid Services (CMS) has revised its regulations governing Medicaid managed care. One purpose of this new Managed Care Rule is to improve access to health care for children, families, and other populations enrolled in Medicaid managed care organizations (MCOs). This blog takes a closer look at the provisions of the rule relating to the adequacy of MCO provider networks: searchable provider directories, analyses of payments to network providers, appointment wait time standards, secret shopper surveys, and remedy plans. For the most part, these provisions are unchanged from those in the regulation CMS proposed in May 2023.

An adequate provider network is essential to access care for people enrolled in Medicaid MCOs, but other factors affect their access to care, including an MCO’s utilization controls, the performance requirements it must meet, and regulatory oversight. While this blog focuses on key provisions in the Managed Care Rule, CMS has issued other regulations and policy guidance that have access implications for people enrolled in Medicaid MCOs, including the companion Access Rule, the February 2024 regulations relating to prior authorization, the September 2023 letter to State Health Officials on continuous eligibility for children, and the August 2023 regulations for reporting of the Child and Behavioral Health Core Sets.

The Managed Care Rule has a general effective date of July 9, 2024. None of the rule’s new access requirements will actually take effect on that date, however. Instead, CMS has set dates for compliance in the expectation that states will implement the new access requirements in stages starting in 2027 through 2029. Of course, there’s nothing in the rule that prevents a state from implementing these provisions more rapidly. By the same token, CMS specification of a compliance date does not necessarily mean that all states will comply by that date.

Provider Directories (July 1, 2025)

The first step in determining the adequacy of a provider network is taking attendance. Current regulations require Medicaid MCOs to post provider directories on their websites and to make them available to beneficiaries, upon request, in paper form. The regulations specify in some detail the information about network providers that the MCOs must include in their directories. In the Consolidated Appropriations Act, 2023 (CAA), Congress revised and codified these requirements to address the problem of “phantom” provider networks. The Managed Care Rule implements these revisions so that effective July 1, 2025 each MCO’s provider directories must be “searchable” and, in addition to information about physicians, hospitals, and pharmacies, include information about mental health and substance use disorder providers in the MCO’s network.

Annual Payment Analysis (2027) 

The adequacy of an MCO’s provider network is foundational to access to care for the people it serves. Whether a network is adequate is determined in part by the MCO’s payment rates for network providers. If an MCO’s payment rates are too low relative to rates paid by other insurers, providers will likely be deterred from joining the MCO’s network, or if they join, from accepting more than a limited number of MCO patients. In addition, safety net providers that serve large numbers of Medicaid beneficiaries for whom they are paid too little may experience shortages in staffing or medical technology that may compromise the quality of care they can offer.

Currently, the way in which MCOs pay their network providers, and the rates at which they pay them, are generally left to the discretion of the MCOs. Except in the case of FQHCs and rural health clinics, current CMS regulations do not specify any payment floors or ceilings (such as Medicare rates). The regulations authorize (but do not require) state Medicaid agencies to require MCOs to use a minimum fee schedule for network providers that provide a particular service; that fee schedule can be the same as the state’s approved fee schedule for its Medicaid fee-for-service program. (The adequacy of the state’s Medicaid fee-for-service rates, which are often lower than Medicare rates, is the focus of new provisions in the companion Access Rule that take effect July 1, 2026).

Beginning in 2027, the new rule requires that contracts between the state Medicaid agency and MCOs provide that the MCOs submit to the agency an annual payment analysis. The payment analysis must provide a total amount paid by the MCO in the immediate prior contract rating period for each of the following types of services: primary care, obstetrical and gynecological, mental health, and substance use disorder. (Payments to FQHCs and RHCs are excluded). For each type of service, the payment analysis must also provide the percentage that the total amount paid represents of what would have been paid had the MCO paid Medicare rates for the services. If that percentage differs between adult and pediatric services, the MCO must provide separate percentages for each group. These amounts and percentages are calculated on an aggregate basis for each service type and do not disclose rates paid to individual providers. The rule does not require that MCOs achieve a minimum percentage (i.e., 90 percent of Medicare rates).

The annual payment analyses submitted by each MCO must be incorporated into the Network Adequacy and Access Assurances Reports (NAAARs) that state Medicaid agencies are currently required to submit to CMS. Under current regulations, states must, at least annually, submit documentation to CMS that the provider network of each MCO with which the state contracts is “sufficient in number, mix, and geographic distribution to meet the needs of the anticipated number of people enrolled in the service area” of the MCO. Under the new Rule, the NAAAR will have to include the data provided by each MCO in its payment analysis and be posted on the state agency’s website within 30 days of submission to CMS.

Appointment Wait Time Standards (2028)

Under current regulations, state Medicaid agencies must develop quantitative network adequacy standards for each of seven different provider types, including primary care, OB/GYN, behavioral health, specialist, hospital, pharmacy, and pediatric dental. In the cases of primary care, behavioral health, and specialist services, the standards must distinguish between adults and children. The regulations do not specify the quantitative standards that states must use; as a result, there is wide variation from state to state.

The rule takes a different approach. Starting in 2028, state Medicaid programs will be required to “establish and enforce” appointment wait time standards for specific services. For routine primary care (adult and pediatric) or obstetric and gynecological visits, appointment wait times cannot exceed 15 business days from the date of request. For routine visits for outpatient mental health and substance use disorder (adult and pediatric), the standard is 10 business days from the date of request. State Medicaid agencies may establish shorter timeframes. In any event, they must post their standards on their websites.

The rule defines compliance with these standards as “a rate of appointment availability … of at least 90 percent.” That is, at least 90 percent of the requests for routine appointments result in appointments within the 10- or 15-day standard (or state-specified standard, if shorter). (Telehealth appointments may count toward compliance if the provider also offers in-person appointments). Whether any individual MCO meets this compliance standard is to be determined by an annual secret shopper survey. State agencies will be required to post the results of the surveys on their websites.

The Rule does not define a “routine” appointment. Instead, CMS “defers to States to define it as they deem appropriate.” This is potentially a large loophole. By counting urgent care visits—for illnesses or injuries that are not emergencies but require prompt attention—as “routine” appointments, a state could make it easier for MCO provider networks to meet the 90 percent threshold.

Annual Secret Shopper Surveys (2029)

The Rule requires state Medicaid agencies to contract with an entity to conduct annual secret shopper surveys no later than 2029. The purpose of these surveys is twofold: to measure each MCO’s compliance with the new appointment wait time standards, and to determine the accuracy of each MCO’s provider directory with respect to primary care, obstetric and gynecological, and outpatient mental health and substance use disorder providers. The secret shopper entities have to be independent of both the state Medicaid agency and any of the MCOs they are surveying. The surveys to measure compliance with appointment wait time standards must be random and cover a statistically valid sample of providers.

Remedy Plans (2029)

The Rule creates a new mechanism for enforcing compliance with the appointment wait time and other access standards: a remedy plan. Starting in 2029, when a state Medicaid agency “identifies an area in which an [MCO’s] access to care under the access standards [in the Rule] could be improved,” the agency has to develop a remedy plan “to address the identified access issue within 12 months.” The Rule identifies a number of “approaches” that a remedy plan could use to address an access problem, including increasing payment rates to providers and improving the timeliness and accuracy of claims payment and prior authorization. The state agency must submit the plan to CMS for approval. If the plan doesn’t result in improvement in access within 12 months, CMS may require the state agency to continue the plan for another 12 months. The Rule does not provide any consequence for either the MCO or the state agency in the event that the remedy plan fails to bring about an improvement in access.

Going Forward (2024)

The timelines for state compliance with the new access requirements are much too long. Even if all states comply by the required rating periods—by no means a forgone conclusion—the rule’s access provisions will not be fully implemented for five years. That said, nothing in the rule prohibits states from implementing ahead of schedule. Advocates can help push their Medicaid agencies to manage to a much more aggressive timeline.

A very good place for advocates to start is with provider directories. By statute, each MCO will have to post on its website a searchable directory of its network providers beginning on July 1, 2025 and update that directory at least quarterly. Advocates could test for whether each MCO has met the posting requirement and included all the information required.

And rather than waiting until 2029, advocates could urge their state agencies to conduct secret shopper surveys to verify the information in the new directories. As our colleagues at the National Health Law Program have pointed out, a number of states already engage their External Quality review organizations for this purpose. The newly constituted Beneficiary Advisory Councils and Medicaid Advisory Committees might be effective forums for such a request. Providing people enrolled in Medicaid with an updated, accurate and user-friendly directory of providers in each MCO network just doesn’t seem like that much to ask.

[This is part of a blog series on two key federal regulations that aim to improve access to care for people enrolled in Medicaid and CHIP across delivery systems. Learn more about the “Ensuring Access to Medicaid Services” and “Medicaid, CHIP Managed Care Access, Finance, and Quality” rules here.]