Provider Data Isn’t Just an Identity Problem. It’s an Evidence Problem.

Identity tells you who the provider is. Evidence tells you whether the record is safe to use, submit, publish, pay, automate, or defend.

For Medicaid network adequacy data, matching two records to the same physician is necessary but not sufficient. Plans must prove the record is current, that systems agree, and that the network file submission compliance trail exists.

In June 2026, OIG reviewed the maternal-health provider network lists that Medicaid managed care plans submitted to five states. Almost half of the providers on those lists did not appear in the same plans’ own online directories. One plan. Two files. Three clocks. Credentialing refreshed on one cycle, the directory on another, and the extract sent to the state was pulled on a third date. Each file may have been current by someone’s definition. But the member and the reviewer were not looking at the same network. 

These were not small plans running on thin staff. The plans reviewed included some of the nation’s largest Medicaid managed care insurers, so this was not a small-plan capacity problem. It showed that major organizations appear to be routinely submitting one version of a network to the state while publishing another to members.

Provider files now do more than keep a roster current. They pay claims, steer members, support encounters, and feed the network lists states use when they assure CMS that a plan is adequate.

A 2026 Sage Growth Partners study, commissioned by Verato, found that only 12 percent of health systems and 12 percent of health plans rate their provider data as excellent. Matching two records to the same physician is necessary work, but it doesn’t prove that the location is open, the phone works, the effective date covers the date of service, or that last quarter’s state submission matches the directory a member sees this week. Medicaid plans are increasingly reviewed on those proofs.

A provider record doesn’t live in one place, and a Medicaid managed care plan doesn’t get to treat it as one team’s problem. Credentialing holds one version. Contracting holds another. Delegated rosters arrive on their own schedule. Claims need effective dates and tax IDs. Directories need a phone number a member can actually dial. Encounter and T-MSIS reporting need identifiers that will survive a state edit. The same record is also what the plan draws on when it builds the network file the state attests from.

Those jobs collide. When the systems underneath them disagree, the plan does not merely have “bad provider data quality.” It may not know which version it relied on, on which date, or why. One stale effective date can be an operational error on Monday, an access complaint on Wednesday, and a finding in the next audit cycle.

The navy box is the provider record the plan maintains. Credentialing, delegated rosters, contracts, state Medicaid enrollment, NPPES, and exclusion lists update it. Prior authorization, claims, the member directory, and encounters use it. The same record is also what the plan draws on when it builds the network file the state attests from. A change in one feed does not reliably reach the others.

Credentialing holds one version. Contracting holds another. Delegated rosters arrive whenever the group sends them, in whatever layout that group uses. Claims need effective dates, tax IDs, locations, and taxonomy. Prior authorization needs network status before the service happens. Directories need a phone number a member can actually dial. Encounter and T-MSIS reporting need identifiers that will survive a state edit. Somewhere in the same stack sits the extract that becomes the network list the state sends on.

Those jobs collide. The file that pays a claim is asked, often the same week, to tell a pregnant member where to go, to support a referral, to populate a public directory, and to stand behind a network adequacy submission. When the systems underneath those jobs disagree, the plan does not merely have “bad data.” It may not know which version it relied on, on which date, or why.

A health system usually feels the miss as leakage or delay: a referral to a closed site, credentialing that lags the contract, patients calling numbers that don’t work. A health plan feels those same fields a second time. They become a member-facing listing, an encounter, or part of the documentation a state uses when it tells CMS the network is adequate. One stale effective date can be an operational error on Monday, an access complaint on Wednesday, and a finding in the next audit cycle.

When four or five systems describe one provider, nobody can say which version was right on the date that mattered.

The NPI That Never Bills

Federal rule requires the ordering or referring professional on a Medicaid claim to be enrolled with the state even when that person never sends a bill. Florida and Arizona call the category ROPA. New York calls it OPRA. Those NPIs land in the same feed that updates your provider record, hold no contract, and render nothing. Florida says plainly they do not count toward adequacy. Florida has been denying these claims since 2021. Arizona added prescribers on September 1.

Learn more in our related post:  What Is ROPA and Why Is It Denying Your Medicaid Claims?

Identity Resolution Is Necessary. Provider Data Evidence Is What Survives Review.

Most of the current vendor conversation treats this as an identity problem. Too many records. Not enough certainty that this Dr. Conway is that Dr. Conway. Matching, deduplication, and master data management are built for that question. Plans that cannot separate two similarly named physicians have a foundation issue and should fix it.

Matching two records to the same physician is necessary, but the industry has talked about that matched row as if it were the finish line. It isn’t. A row can be agreed and still be wrong on the date of service. Identity tells you which Dr. Conway. It does not tell you which version of Dr. Conway the plan submitted in March.

A perfectly deduplicated roster still fails if the effective date is stale, the location closed months ago, the phone number doesn’t work, or the provider stopped taking new patients but nobody recorded that. As an attribute, identity belongs to the person. Currency, agreement across systems, and provenance belong to the record. Those attributes determine whether the record survives contact with an adjudication engine, a secret shopper, or a state desk review.

You can finish the identity project and still have nothing useful to hand an auditor. A tidy file with no timestamps, no source history, and no exception log looks better than the mess it replaced. It is not the same thing as a defensible file.

A plan that can say four percent of a roster is unverified, show which records those are, and show what was done to fix the problem is often in a stronger position than a plan with a tidier file and no proof of how it got that way.

Identity work improves the record. Evidence work improves the answer. Auditors ask for the answer.

Your Network File Is Now a Regulated Submission

In June 2026, the HHS Office of Inspector General reviewed maternal-health providers on the network lists Medicaid managed care plans sent to five states. About one in four of those listed providers told OIG they were not in network. Plans had no accurate phone number for more than a quarter of the names on the list.

A second finding is easy to skip but matters. Nearly half of the providers on those state-bound lists did not appear in the same plans’ online directories. That means the file the regulator received and the directory the member used were not describing the same network.
Nobody has to be cooking the books for that to happen. Different teams. Different refresh cycles. Different source systems. Different business rules about when a termination is “real enough” to publish. From an access or review standpoint the effect is identical: one plan, two artifacts, two versions of the network.

“The question a plan should be able to answer within hours is whether its network list and its member directory describe the same network. If you can’t, that gap is where findings come from.”

— Bret Randolph, COO, CureIS Healthcare

The reason this is not a directory-hygiene story is what the state does with the list. Under 42 CFR 438.207(d) and (e), states submit assurances to CMS that each contracted MCO, PIHP, and PAHP meets the state’s availability-of-services rules. Those assurances rest on documentation, including the Network Adequacy and Access Assurances Report (NAAAR). The plan does not file that federal assurance. The state does. The plan supplies the network data underneath it.

So the plan’s provider file is no longer only an operational extract. It’s raw material for a state’s federal attestation. A data-quality miss on the plan side can become a compliance problem on the state side, and then come back as a corrective action, extra oversight, withheld payments, or an enrollment cap.

In that light, the network file is evidence.

Medicare Advantage Gets a Machine Check. Medicaid Often Gets a Finding.

The Industry Is Measuring Quality. Plans Still Have to Prove Integrity.

A 2026 Sage Growth Partners study, commissioned by Verato, put numbers under a frustration most network teams already have. 85 percent of health systems and 78 percent of health plans said their top strategic priorities depend on accurate, timely, accessible provider data. Yet only 12 percent of each group rated their own data as excellent.

That’s telling, but the study only involved large enterprises. Every health-system respondent came from an organization with at least $1 billion in annual net patient revenue. More than half the health-plan respondents covered a million lives or more. In that segment the problem is often framed as consolidation: too many systems, too many records, not enough master-data control.

For a community Medicaid plan, the question is probably not “How do we retire five systems?” It’s more likely to be: “Can we defend the file we sent last quarter?” That’s a different problem, which requires a different operating discipline.

The Oversight Trend Is Not Letting Up

CMS reviewed Medicare Advantage online directories in three rounds between 2016 and 2018. In the two later rounds, 52 percent and 48.7 percent of reviewed locations had at least one inaccuracy. An October 2025 OIG data brief found that 72 percent of sampled inactive behavioral health providers in MA and Medicaid managed care networks should not have been listed at all. The June 2026 maternal-health reports landed on top of that record.

The reporting burden is also growing. Payment-analysis data required under 42 CFR 438.207(d)(2) applies to rating periods beginning on or after July 9, 2026, which means NAAAR submissions on or after January 1, 2028 must carry it. More fields. Same plan-side data.

Directory rules are tightening on both sides of the aisle. CMS-4208-F2 pulls MA directory data toward Medicare Plan Finder, with update clocks and annual attestations. Medicaid electronic directories already have to be updated within 30 calendar days of the plan receiving new provider information, under 42 CFR 438.10(h)(3)(ii). CMS resumed T-MSIS data-quality compliance actions on September 1, 2025. States feel that first. Plans feel the extra oversight through encounter rejects, corrective-action language, and another pass over the network file.

The error is only the start of the problem. The expensive part is not being able to explain the field when someone with authority asks how it got there.

Where to Start: Build Evidence Readiness Before You Build Automation

A field without a date is not evidence. Reproducibility means being able to rebuild what you submitted, what you published, or what you paid from, as of the date that mattered.

Most plans don’t need a full provider MDM program to get that far. They need a reconciliation layer across the systems they already run. Start with one high-risk population and make the disagreement visible.

1. Pick one population. Behavioral or maternal health are where referrals stall, where regulators are already looking, and where the public findings landed.
2. Pull the same NPIs from credentialing, contracting, prior authorization, claims, the public directory, encounter submissions, and any delegated rosters.
3. Count the disagreements. Conflicting effective dates. Listed as accepting patients with no activity in 18 months. A phone number no two systems share. That count is the baseline. It is usually the moment “we need a golden record” turns into “we cannot show our work.”
4. Score the seams, then conform the fields. Decide which source wins for each field, under which conditions, and preserve the lineage behind that decision.
5. Automate later and narrowly, with a human in command. Surface, flag, route, assemble. A qualified person makes the calls that change network status, payment, or a member’s path to care.

None of that replaces credentialing, contracting, claims, prior authorization, or the directory vendor. It gives those systems a governed way to agree, or to document that they do not.

A Practical Litmus

Instead of asking “is our provider data accurate?” ask: “if the state asked us today to substantiate the network file we submitted last quarter, what could we actually produce?”

If the answer is only the file itself, you have a directory. If the answer includes where each field came from, when it was verified, what was known to be weak, and what was done about it, you have evidence.

Closing that gap is almost always cheaper than answering a finding after the file has already been used against you.

About CureIS

CureIS has spent the past 20 years helping managed care organizations spend less to do more. 

CureIS UniSync is a powerful conformance-and-reconciliation platform that operates alongside your existing systems, creating the trusted data foundation needed for audit response, network adequacy reporting, encounter improvement, eligibility reconciliation, and claims operations. It provides a point-in-time provider view with lineage across credentialing, contracting, prior authorization, claims, directories, encounters, and delegated feeds.

Discover what needs to be fixed before a reviewer does. Request our free Defensibility Assessment on one high-risk population. 

Frequently Asked Questions

Is provider data a compliance problem or a data quality problem?
Both. It becomes a compliance problem when the data is submitted to the state and used to support a federal network adequacy assurance.

Who is responsible for Medicaid network adequacy: the plan or the state?
The state files the assurance to CMS, but the plan supplies the underlying network data. That means the plan may not make the final adequacy determination, but its data still drives the result.

What did the June 2026 OIG report find?
On the network lists plans sent to states, about one in four listed maternal-health providers said they were not in network, more than a quarter had no accurate phone number, and nearly half of the listed names were missing from those plans’ own online directories. A companion report on member-facing directories found a different mix of ghost listings, missing in-network names, and bad contact data.

How is Medicaid network adequacy different from Medicare Advantage?
Medicare Advantage uses standardized HSD tables and automated HPMS scoring. Medicaid managed care has no single federal file format or automated pre-submission check; each state sets its own requirements.

Do we need an MDM to fix this?
Not as the first move. MDM helps resolve who the provider is. Defensibility requires something else: what was submitted or published, when, from which source, and whether that can be rebuilt.

What’s the fastest way to find out whether our network file is defensible?
Compare the latest state submission with the live online directory. Then try to reproduce the submitted file as it existed on the submission date. Anything you can’t reproduce is exposure.

Does CureIS UniSync replace our credentialing or provider data system?
No. UniSync runs alongside existing systems to conform, reconcile, and trust-score provider data, and to preserve lineage at the transaction level.

Sources & References

U.S. Department of Health and Human Services, Office of Inspector General. “Inaccurate Medicaid Managed Care Network Lists May Compromise State Oversight of Access to Maternal Health Care.” OEI-05-24-00091, June 2026.

U.S. Department of Health and Human Services, Office of Inspector General. “Inaccurate Medicaid Managed Care Provider Directories May Limit Enrollees’ Access to Maternal Health Care.” OEI-05-24-00090, June 2026.

U.S. Department of Health and Human Services, Office of Inspector General. “Many Medicare Advantage and Medicaid Managed Care Plans Have Limited Behavioral Health Provider Networks and Inactive Providers.” OEI-02-23-00540, data brief, October 2025. (72% of sampled inactive behavioral health providers should not have been listed.)

Sage Growth Partners/Verato. “Provider Data: The Foundation Health Systems and Health Plans Haven’t Built Yet.” 2026. (85% of health systems and 78% of health plans; 12% of each group rating quality excellent; health-system respondents at $1B+ NPR; 58% of health-plan respondents covering 1M+ lives.)

Centers for Medicare & Medicaid Services / Medicaid.gov. “Network Adequacy and Access Assurances Report (NAAAR)” FAQ, July 31, 2025. (Authority at 42 CFR 438.207(d) and (e); standard Excel template mandatory as of October 1, 2022; MDCT-MCR portal submission available as of July 30, 2025; payment analysis data under 438.207(d)(2) for rating periods beginning on or after July 9, 2026, appearing in NAAARs submitted on or after January 1, 2028.)

Centers for Medicare & Medicaid Services. “Medicaid and CHIP Managed Care Reporting.” Guidance page.

Centers for Medicare & Medicaid Services. Online Provider Directory Review Reports, Rounds 2 and 3, 2018. (52.20% and 48.74% of reviewed provider locations contained at least one inaccuracy.)

Centers for Medicare & Medicaid Services. Health Service Delivery table guidance and HPMS Automated Criteria Check reporting. (PASS / FAIL results per provider and facility; HSD zip code report identifying areas of inadequate access.)

Centers for Medicare & Medicaid Services. “Medicare Advantage and Section 1876 Cost Plan Network Adequacy Guidance.” December 2023.

42 CFR 438.10(h)(3)(ii). Electronic provider directory must be updated no later than 30 calendar days after the plan receives updated provider information.

Centers for Medicare & Medicaid Services. State Health Official letter SHO 25-002, “Data Reporting Compliance for the Transformed Medicaid Statistical Information System (T-MSIS),” May 28, 2025. (Data-quality compliance actions resumed September 1, 2025.)