CMS Mandate — Effective January 1, 2025

Is Your Plan CMS Compliant? The Clock Is Running.

The Centers for Medicare & Medicaid Services now mandates annual Secret Shopper surveys for all QHP issuers. Non-compliance risks decertification, corrective action plans, and public penalties — all before your next open enrollment.

Survey window: January 1 – May 31 annually 90% compliance rate required Third-party vendor mandatory Results reported directly to CMS Specialty care scope expanding in future years Medicaid mandate deadline: July 2027 Public posting of results required within 30 days Survey window: January 1 – May 31 annually 90% compliance rate required Third-party vendor mandatory Results reported directly to CMS Specialty care scope expanding in future years Medicaid mandate deadline: July 2027 Public posting of results required within 30 days
Why This Matters Now

Ghost Networks Are Under the Microscope

CMS has documented that a quarter of all insured adults encountered in-network providers who had no available appointments. Among Medicaid enrollees, that number jumps to 33%. The federal government is done waiting — and your plan can't afford to be caught without a compliant survey process.

33%
of Medicaid enrollees couldn't get an in-network appointment when needed
26
average days wait time in the 15 largest U.S. cities (2022 baseline)
90%
minimum appointment-within-standard compliance rate CMS requires
~50%
of FFE enrollees are new patients each year — most vulnerable to access failures

What's Required of Your Organization

Effective January 1, 2025, CMS requires all QHP issuers in Federally Facilitated Exchanges to satisfy six non-negotiable obligations — and the scope will only grow.

📋
Contract a Third-Party Vendor

You cannot self-administer. CMS explicitly requires medical QHP issuers to contract with an independent third-party entity to conduct all secret shopper surveys.

Mandatory
📞
Call as a New Patient

Survey calls must simulate a brand-new patient seeking their first-ever appointment — testing real-world access, not theoretical network participation.

Protocol Required
🗓
Complete by May 31 Each Year

Surveys must begin on or shortly after January 1st and be fully completed by May 31 of each plan year — a hard federal deadline with no extensions.

Annual Deadline
📊
Statistically Valid Sample

CMS provides a "provider population file" each fall. Your third-party vendor must draw a randomized, statistically valid oversample from that list.

CMS-Specified Methodology
🏥
Cover Primary Care & Behavioral Health

2025 requires Primary Care (routine) and Behavioral Health. CMS has signaled specialty care will be added in future plan years — prepare now.

Expanding Scope
📤
Report Results to CMS

Survey results must be submitted to CMS as part of QHP issuer compliance monitoring. CMS can demand underlying documentation at any time for review.

Federal Submission

The 90% Rule — By Provider Type

Provider Type Visit Category Max Wait Time
Primary Care Routine / Non-urgent 15 Business Days
Primary Care Urgent Care 4 Business Days
Behavioral Health / SUD Non-urgent Outpatient 10 Business Days
Behavioral Health / SUD Urgent Outpatient 4 Business Days
OB/GYN (Medicaid) Routine 15 Business Days
Specialty Care Non-urgent (Future Years) TBD by CMS

Important: Telehealth appointments may count toward compliance only if the provider also offers in-person visits. Plans cannot satisfy wait time standards through telehealth alone. Both in-person and telehealth availability must be separately documented in survey results.

The Cost of Doing Nothing

Failing to conduct surveys, missing reporting deadlines, or falling below the 90% threshold triggers a cascade of enforcement actions that threaten your plan's very existence on the Marketplace.

Risk Level: Critical Plan Decertification
CMS reserves the right to decertify any QHP that does not meet all applicable certification standards — including secret shopper compliance. A decertified plan is removed from HealthCare.gov before Open Enrollment, effectively shutting off your exchange market access.
Risk Level: High Mandatory Corrective Action Plans
Issuers who fail to meet the 90% appointment wait time threshold or report deficiencies must submit a formal Corrective Action Plan to CMS — identifying responsible parties, specific remediation steps, and a timeline, all subject to federal review and follow-up audits.
Risk Level: High Forced Network Expansion
Issuers who fail the survey or miss reporting requirements must add more contracted providers to their network to achieve alignment with CMS standards — a costly, time-intensive remediation that could have been avoided entirely with a compliant survey program.
Risk Level: High Loss of Federal Financial Participation
For Medicaid managed care plans, CMS has existing authority to disallow Federal Financial Participation (FFP) for managed care contract payments when access issues rise to a defined threshold — meaning your federal funding can be withheld directly.
Risk Level: Reputational Public Results Posting
Secret shopper results are reported to CMS and must be publicly posted on state websites within 30 calendar days of submission. Poor performance is visible to enrollees, advocates, regulators, and competitors — permanently damaging plan reputation and enrollment.
Risk Level: Moderate Enrollment Suspension
States and CMS may suspend new enrollment after a sanction has been imposed on a Medicaid managed care plan — cutting off a primary revenue channel until the underlying access deficiency has been fully resolved to CMS's satisfaction.
✓ Turnkey Solution

We Handle It All. A to Z.

From the moment CMS delivers your provider population file each fall to the final submission of survey results, our team manages every step of the process — so your compliance team doesn't have to build infrastructure from scratch or risk a missed deadline.

01
Provider Population File Intake & Sample Design

We receive and process the CMS-issued provider population file on your behalf each fall, then design a statistically valid, randomized oversample that satisfies CMS methodology requirements — stratified by geography, specialty type, and network ID.

September – December
02
Secret Shopper Calling & Provider Outreach

Our trained surveyors contact providers presenting as new patients, following CMS-compliant scripts. We document active network status, street address, phone number, new patient acceptance, and available appointment dates — both in-person and telehealth.

January 1 – May 31
03
Appointment Wait Time Calculation

We calculate appointment wait times in business days per CMS's exact technical guidance — excluding federal holidays and weekends, applying correct disposition codes (A, B, J, K, S, T), and computing compliance rates per provider network ID.

Ongoing During Survey Window
04
Provider Directory Accuracy Validation

Beyond appointment wait times, we verify four CMS-required data points for every provider contacted: active network status, accurate street address, correct telephone number, and new patient acceptance. All directory errors are flagged and reported within 3 business days of identification.

Real-Time Error Reporting
05
Compliance Rate Analysis & Gap Assessment

We compute your compliance rate numerator, denominator, and final percentage per provider type and per network ID. If results approach the 90% threshold, we immediately alert your team and provide actionable network gap analysis to support corrective hiring or contracting before the window closes.

Actionable Analytics
06
CMS Results Submission & Documentation Package

We prepare and submit your complete survey results to CMS in the required format as part of QHP issuer compliance and monitoring activities — and retain all underlying documentation required for potential CMS audit or request for supporting materials.

Before May 31 Deadline

Built for This Mandate

We don't adapt a generic mystery shopping program to healthcare. Our entire infrastructure is architected around CMS's technical guidance, HIPAA requirements, and the operational realities of provider network management.

🔒

HIPAA-Compliant Operations

Every call, every record, every data transfer is handled under strict HIPAA protocols. Our surveyors are trained on healthcare-specific compliance, not generic retail mystery shopping.

📐

CMS Technical Guide Precision

We follow CMS's Appointment Wait Time Secret Shopper Survey Technical Guide exactly — including disposition codes, business-day calculations, and required data fields in CMS submission format.

3-Business-Day Error Reporting

CMS requires provider directory errors to be reported within 3 business days of identification. Our real-time tracking system guarantees that timeline is never missed.

📈

Network Gap Intelligence

We don't just report compliance. We identify exactly where your network is failing — by county, specialty, and provider type — so you can act before results go to CMS.

🗺

National Coverage

We operate across all 50 states, supporting QHP issuers in all Federally Facilitated Exchanges and State-Based Exchanges — in-person, telehealth, and online visit modalities included.

📅

Future-Proof as Scope Expands

CMS has signaled specialty care surveys are coming. Our platform is already built to add specialty care provider types seamlessly — no mid-year scramble when the mandate grows.

Your Next Step

Don't Let a Missed Deadline
Cost You Your Certification

The survey window opens January 1st every year and closes May 31st. There are no extensions, no grace periods, and no second chances before CMS reviews your results. Contact us now to get your contract in place and your program ready.

Schedule a Consultation

Agreements must be in place before surveys begin. Contact us before Q4 to ensure a seamless January 1st launch.