Payer Directory Verification: The 90-Day Cycle That Quietly Removes Practices From the Network
Health plans have to verify provider directory data at least every 90 days under the No Surprises Act, and a provider who cannot be verified can be removed from the directory until the information is confirmed. For a practice where 30 to 50 percent of new patients arrive through a plan's find-a-doctor search, a suppressed listing is a referral outage with no error message. There is no denial, no rejection report, and no notice in the practice management system. The schedule just gets thinner.
This article provides general operational guidance on medical billing practices. It is not legal, compliance, or financial advice. Consult qualified healthcare billing counsel or a certified professional coder for your specific situation.
Credentialing and enrollment requirements vary by payer and change frequently. Verify current requirements directly with each payer.
The Short Answer
Directory attestation is not a credentialing task and it does not end when enrollment is approved. It is a recurring data obligation with a quarterly cadence, it usually arrives by email to whoever signed the last application, and the penalty for ignoring it is invisible: quiet removal from the search results patients actually use. Assign it to a named person, treat every attestation request as a deadline, and audit the live listings quarterly rather than trusting the payer portal.
What the Law Actually Requires, and of Whom
The Consolidated Appropriations Act, 2021, which carries the No Surprises Act, put directory accuracy on a statutory footing for the first time. The obligations split in two directions, and practices routinely misread which side they are on.
The plan or issuer carries the verification duty. It must verify and update directory information at least once every 90 days, establish a process to remove providers whose information cannot be verified, and respond to a patient's request about a provider's network status within one business day. The removal authority is the part that matters operationally: a plan that cannot confirm a listing is expected to act on it, and acting on it means taking the listing down.
The practice carries the submission duty. Directory information has to be provided when a network agreement begins, when it terminates, when material information changes, and whenever the plan asks. "Material change" is broader than most practices assume. A new suite number, a provider who stopped accepting new patients, a second location that closed, a phone number rolled into a new answering service, a specialty designation that no longer matches the panel: each of these is a change the plan is entitled to be told about, and each is a mismatch that can trigger suppression at the next verification pass.
There is a patient-side consequence that shapes how seriously plans take this. When a patient relies on inaccurate directory information and receives care from a provider listed as in-network who is not, the patient owes only the in-network cost-sharing amount. The plan absorbs the difference. That exposure is why verification cycles got aggressive after 2022, and why non-response is now treated as a reason to remove rather than a reason to call.
| Trigger | What the plan does | What the practice must do | Who owns it |
|---|---|---|---|
| Routine verification cycle | Verifies directory data at least every 90 days | Respond to the attestation request before the stated deadline | Practice manager or credentialing service |
| New network agreement | Loads the listing | Submit full directory data at contract effective date | Credentialing service |
| Material change (address, phone, panel status, specialty) | Updates or suppresses the listing | Notify every contracted plan, not just the largest | Practice manager |
| Termination of a provider or location | Removes the listing | Notify at termination, not at the next cycle | Practice manager |
| No response to verification | May remove the provider from the directory | Re-attest and confirm the listing is restored | Practice manager or credentialing service |
Why the request never reaches the right person
The structural failure is almost always routing. Attestation requests go to the email address on the most recent credentialing application, which is frequently a departed office manager, a billing company's shared inbox, or a personal address used once during onboarding three years ago. The message reads like vendor marketing, arrives quarterly from six to ten different payers on six to ten different schedules, and carries a deadline buried in the third paragraph. Practices that have never missed a credentialing deadline miss these constantly, because credentialing has an owner and directory attestation usually does not.
What Suppression Costs, and Why It Is Hard to See
The revenue effect is real but it arrives without a signal. Work the arithmetic on a primary care panel that adds 15 to 25 new patients a month. At 30 to 50 percent arriving through plan directory search and an average first-year value in the low four figures, that is roughly 55 to 150 patients a year, or $50,000 to $200,000 of annual new-patient revenue riding on listings nobody checks. These are modeled ranges built from the practice's own volume, not a market statistic. Specialty practices dependent on self-referral through plan search tools sit at the higher end of that exposure; practices whose volume comes from physician referral relationships sit well below it.
What makes this category unusual is that every normal practice dashboard is blind to it. Denial rate is unaffected. Days in accounts receivable are unaffected. Collections per encounter is unaffected. Only new-patient volume moves, and it moves slowly enough that it reads as seasonality for a quarter or more before anyone connects it to a listing. By the time the pattern is visible, the practice has usually lost two verification cycles.
Implementation: What Practices Actually Do
- Build a payer directory register: one row per contracted plan and product, listing the attestation portal or method, the cadence, the last attestation date, the next due date, and the contact address the payer currently has on file. Most practices discover during this exercise that two or three payers are writing to an address nobody reads.
- Point every payer at a role-based mailbox: a shared address such as credentialing@ the practice domain, monitored by a named person with a named backup. Never a personal address, and never the departing manager's. Update it with every payer at the same time rather than one at a time.
- Run a quarterly live listing audit: search each plan's public find-a-doctor tool as a patient would, for every provider and every location. Check the address, suite, phone, specialty, and accepting-new-patients flag. The portal view and the public view disagree more often than practices expect, and the public view is the one patients see.
- Attach a directory step to every operational change: a provider departure, a new hire, a location move, a phone system change, or a panel closure triggers directory notification to every contracted plan on the same checklist that handles the rest of the transition. Fold it into the credentialing workflow you already run, alongside the enrollment steps in a practice credentialing roadmap.
- Track new-patient volume by source monthly: without a source split, directory suppression is indistinguishable from a slow month. With one, a drop in plan-search arrivals is visible inside a single cycle.
- Keep the attestation record: save confirmation of every attestation with its date. When a listing disappears anyway, the dated confirmation is what gets it restored quickly rather than re-entering the queue.
What Goes Wrong
- Treating attestation as part of credentialing: credentialing has a defined end and a defined owner; directory verification recurs every 90 days and usually has neither.
- Attesting only with the largest payers: the smaller contracts are where suppression goes unnoticed longest, and they are frequently the ones with the tightest response windows.
- Trusting the payer portal over the public listing: an internal record showing a current address does not mean the patient-facing search shows it.
- Leaving accepting-new-patients set incorrectly: a stale closed-panel flag suppresses the practice from search results as effectively as a removal, and it is the single most commonly wrong field.
- Letting a departing manager's mailbox stay on file: the practice keeps meeting deadlines it never sees, until it does not.
- Reading a volume dip as seasonality: without a source split on new patients, the diagnosis arrives one or two cycles late.
What Should You Do
Start with an audit, not a process. Search every contracted plan's public directory for every provider and location this week and write down what is wrong. Most practices find at least one material error, and a meaningful share find at least one provider or location that is not listed at all. That list is the case for assigning an owner, and it converts an abstract compliance obligation into a specific count of listings that are currently failing to route patients. From there, the ongoing work is a register, a role-based mailbox, and a quarterly recheck, which is perhaps two hours a quarter against a new-patient exposure that runs well into five and six figures annually for most primary care and self-referral specialty practices.
Get the full practice management guide at GetPracticeHelp -- with billing benchmarks, credentialing checklists, and revenue cycle best practices.
Frequently Asked Questions
- How often do health plans have to verify provider directory information?
- At least once every 90 days under the No Surprises Act provisions of the Consolidated Appropriations Act, 2021. The verification duty sits with the plan or issuer; the practice's duty is to supply and confirm accurate information when the plan asks, at the start and end of a network agreement, and whenever material information changes.
- Can a plan remove a practice from its directory for not responding?
- Yes. Plans are expected to have a process for removing providers whose directory information cannot be verified. Removal is not a penalty in the disciplinary sense, and it does not terminate the contract, but the practical effect is that the practice disappears from the search tool patients use while remaining fully in-network on paper.
- What counts as a material change that has to be reported?
- Anything a patient would rely on to reach the practice or judge availability: address including suite number, phone number, provider roster, specialty designation, languages, and whether the panel is accepting new patients. The accepting-new-patients flag is the field most often left stale and one of the most consequential, because a closed-panel setting removes the listing from search results in most plan tools.
- Does a directory error mean the patient owes out-of-network cost-sharing?
- No. When a patient relies on inaccurate directory information showing a provider as in-network, the patient's cost-sharing is limited to the in-network amount. That protection is why plans treat unverified listings as a liability and act on them rather than leaving them in place.
- Should a credentialing service handle directory attestation?
- Many will, but it has to be named in the scope of work rather than assumed. Credentialing engagements are frequently scoped to initial enrollment and revalidation, which leaves the quarterly attestation cycle unowned. Ask directly whether ongoing directory attestation across every contracted plan is included, and if it is, ask how the confirmation record is returned to the practice.