The No Surprises Act requires health plans to verify provider directory entries at least every 90 days and update them within 2 business days of a provider's report. Practices must have business processes to send directory information to plans when they join or leave a network, when details materially change, and when asked.
Last verified: November 9, 2026.
General information, not legal advice. The statute is summarized below with citations; state law, your payer contracts and later federal guidance can add obligations. Talk to counsel or your compliance lead about how these rules apply to your practice.
A patient finds your practice in their insurer's directory, books, and gets an out-of-network bill. Or the listing shows a phone number you dropped years ago, and the patient books elsewhere. Since 2022, federal law has put duties on both sides: the plan that publishes the directory and the practice listed in it.
This guide covers each side's legal duties, what research found, and a quarterly routine for practice managers.
What the No Surprises Act requires of health plans
The directory rules for plans sit in Public Health Service Act section 2799A-5, codified at 42 U.S.C. 300gg-115. For plan years beginning on or after January 1, 2022, a group health plan or health insurance issuer must:
Verify and update the directory information for every provider and facility in its online database at least once every 90 days.
Have a removal procedure for providers or facilities whose information it cannot verify within a period the plan sets.
Update the database within 2 business days of receiving information from a provider or facility.
Answer network-status questions: when an enrollee asks by phone whether a provider is in network, respond in writing (electronic or print, as the enrollee asks) no later than 1 business day after the call, and keep that response in the enrollee's file for at least 2 years.
Publish a public online database listing each contracted provider and facility with its directory information. Print directories must say the information was accurate as of the publication date and point people to the online database.
The statute defines provider directory information as the name, address, specialty, telephone number and digital contact information of each contracted provider or facility.
There is also a cost-sharing protection. If an enrollee sees an out-of-network provider after the plan's directory, database or response told them the provider was in network, the plan may not charge more than in-network cost sharing, and must count the payment toward the in-network deductible and out-of-pocket maximum.
What the No Surprises Act requires of practices
The provider side is PHS Act section 2799B-9, codified at 42 U.S.C. 300gg-139. It has two parts that matter to a practice.
Business processes (required). Beginning no later than January 1, 2022, each health care provider and facility must have business processes to ensure the timely provision of provider directory information to plans and issuers. At a minimum, the practice must submit directory information:
when it begins a network agreement with a plan or issuer;
when it terminates a network agreement;
when there are material changes to its directory information; and
at any other time the provider, facility or the Secretary considers appropriate, including when the plan or issuer asks.
Refunds (required). If a provider bills an enrollee more than in-network cost sharing in a case the plan rule prohibits (the enrollee relied on wrong in-network information), and the enrollee pays, the provider must refund the excess plus interest at a rate set by the Secretary.
The statute also says a provider may require, in its contract or its termination, that the plan remove it from the directory at termination, or that the plan bear financial responsibility for giving enrollees inaccurate network status. Neither section preempts state directory laws, so your state may require more.
Who these rules cover
According to CMS, the No Surprises rules generally apply to people in group health plans, group or individual health insurance, and Federal Employees Health Benefits plans. CMS states they do not apply to coverage through Medicare, Medicaid, Indian Health Services, Veterans Affairs Health Care or TRICARE, which have other protections. Directory accuracy still matters for those programs, but the source of any rule is different.
Where enforcement and rulemaking stand
In August 2021, the Departments of Labor, HHS and the Treasury published FAQs Part 49. Question 8 said the Departments intended to write regulations for the provider directory requirements but would not do so before January 1, 2022. Until then, plans and issuers were expected to implement the provisions using a good faith, reasonable interpretation of the statute. Pending rulemaking, the Departments said they would not treat a plan as out of compliance with the directory requirements as long as it limited cost sharing to in-network levels when an enrollee relied on wrong directory information.
As of November 9, 2026, we did not find a final rule implementing these directory provisions. That FAQ addresses plans and issuers; it does not create a safe harbor for practices. The statutory duties on providers took effect January 1, 2022 regardless. Check the CMS No Surprises pages for newer guidance before relying on this summary.
What the research found about directory accuracy
The most useful recent evidence is a two-stage secret-shopper study published in the American Journal of Managed Care (PMC12705072), supported in part by CMS. Researchers first called providers listed in the online directories of 5 carriers in the Pennsylvania ACA marketplace in June to November 2022, across 7 specialties: cardiology, dermatology, endocrinology, gastroenterology, neurology, obstetrics-gynecology and primary care. They then rechecked 1,802 of the listings that had been wrong, between December 2023 and January 2024.
At follow-up:
| Outcome among 1,802 previously inaccurate listings | Share |
|---|---|
| Removed from the directory | 25.0% |
| Listed accurately | 13.3% |
| Still listed with an inaccuracy | 40.3% |
| Could not be reached to verify | 21.4% |
| Inaccurate contact information | 31.0% |
| Listed under the wrong specialty | 11.2% |
| Listed in network but actually out of network | 1.9% |
The median gap between the two calls for persistent errors was 544 days, far beyond the 90-day verification cycle. Error rates differed widely by carrier and were lower in the state's two metropolitan pricing regions. The authors note limits: one state, selected specialties, and calls ended at the first error found, so the true error rate may be higher.
The takeaway: do not assume the plan will catch your old phone number or a departed provider. The most common error was contact information, which is exactly the data a practice controls.
Why a wrong listing costs a practice
Missed patients. A dead phone number or old address in a payer directory sends in-network patients elsewhere, and you never see the lost call.
Billing exposure. If a patient relied on a plan's wrong in-network listing, federal law limits their cost sharing to in-network levels, and the practice may owe a refund with interest if it billed more and was paid.
Wrong specialty, wrong referrals. One in nine rechecked listings in the Pennsylvania study had the wrong specialty, which affects who finds the provider at all.
A quarterly directory routine for practice managers
The statute sets minimum triggers. A simple calendar keeps you ahead of them. Run this every quarter and after any change in staff, location, phone system or network contract.
1. Build a single source of truth
Keep one spreadsheet with a row per provider and location: legal name, NPI, primary specialty, address, phone, website, new-patient status and every plan network. Compare everything else against it.
2. Check the public NPI record first
Look up each provider in the CMS NPPES NPI Registry and confirm the practice location, phone and primary taxonomy match your sheet. Many directories and data vendors start from NPPES, so an old address there tends to reappear elsewhere. Providers change it by signing in to NPPES at nppes.cms.hhs.gov, and the public provider data guide explains what NPPES, CMS and HRSA each publish.
3. Search each payer directory as a patient would
Open each plan's public directory, search by provider name and by specialty near your address, and record what a patient sees: address, phone, specialty, network status and new-patient status. Screenshot anything wrong with the date.
4. Send corrections through the plan's channel and keep proof
Use each plan's provider portal, roster process or directory update form. Note the date and confirmation number. The statute gives plans 2 business days to update their database after receiving your information, so recheck after a week and escalate through your provider relations contact if nothing changed.
5. Answer verification requests on time
Plans must verify every 90 days, which means you will receive attestation requests by email, portal, fax or phone. Assign one owner, log each request and its response date, and do not let them pile up in a shared inbox.
6. Update the rest of the public record
Fix your own website's provider pages and location pages, your Google Business Profile, and Medicare's Care Compare information where it applies. Patients cross-check these sources.
7. Handle departures and new hires the same day
When a provider leaves, tell every plan in writing at termination and ask that the provider be removed, as the statute permits you to require in the contract. When a provider joins, submit their directory information when the network agreement begins.
How to spot mismatches fast
The slowest part of the routine is comparing what your website says with what the public record says. The free ClinicStats scan reads your site and checks the providers it names against the CMS NPPES NPI Registry, along with 19 other checks for findability, trust and booking. It does not log into payer portals, so steps 3 to 5 above still need a person, but it gives you a quick first list of differences to fix.