.png)
.png)
A letter grade on every directory, a cost-sharing penalty for every bad listing, and a 44% error rate CMS sat on for two years. What the CY2028 proposed rule means for plans, agents, and members.
Comments are due December 15, 2026. Here's what's in it and what I think is worth arguing about.
1. Directories get a report card
Starting in contract year 2028, every MA plan has to verify every listed provider at least once every 90 days, with hospitals and facilities checked at least annually. Providers who can't be verified get flagged in the directory as potentially out of date, and departed providers must be removed within five business days.
Then comes the grade. Each plan runs an annual accuracy analysis on a random provider sample and reports a score to CMS. The proposed weighting: network participation 40%, phone 20%, address 20%, specialty 10%, new-patient status 3%, accommodations 3.5%, telehealth 3.5%, converted to a letter grade. From contract year 2029, plans display the grade in the directory itself as "Information Accuracy," and CMS publishes scores in machine-readable form, with Medicare Plan Finder placement under consideration.
That turns a back-office compliance metric into a shopping signal sitting next to Star Ratings. Creative pressure, and hard-earned.
2. The number CMS waited to publish
The preamble finally discloses the agency's own findings. CMS reviewed online directories from June 2022 to June 2024, covering 11,360 providers and 18,852 locations across 142 Medicare Advantage organizations. Of the location listings, 44.29 percent had at least one inaccuracy. The rate held across high-volume specialties: 45.73 percent of primary care listings, 47.66 percent of cardiology listings, and 45.67 percent of oncology listings had deficiencies.
This isn't new information so much as newly admitted. A 2018 CMS review found inaccuracies ranging from 5% to 93% of listings depending on the plan, and a 2023 JAMA study found inconsistencies in physician address or specialty information among 81% of entries across five large national insurers. Nearly a decade of audits, warning letters, and attestations hasn't moved the number. That context matters for judging whether a letter grade will.
3. A real penalty, with the burden of proof flipped
Here's the provision that changes member-service workflows. If an enrollee sees a provider who was listed as in-network in the online directory on the date the appointment was made, the enrollee owes the lesser of in-network or otherwise applicable cost sharing, even if the provider turns out to be out of network. That amount counts toward the out-of-pocket maximum.
The documentation requirement is the teeth. Plans would be required to maintain daily archives of their online provider directories for at least 10 years and make records available to CMS within five business days of a request. If a plan can't produce what the directory showed on the booking date, the member's account wins. And plans must apply the protection without an enrollee request when they know, or should reasonably know, that it applies.
Every "but the agent told me my doctor was in-network" complaint now has a regulatory home, a snapshot, and a default outcome.
4. Directories must disclose who owns the doctor
Among the nine directory elements required in each listing would be specialty, new-patient status, disability accommodations, cultural and linguistic capabilities, telehealth capabilities, and common ownership or control disclosure. In practice, directories will have to flag providers that sit inside the insurer's own corporate family. CMS frames this as useful to agents and brokers, which is a quiet acknowledgment of how much steering happens at the point of enrollment.
5. PBMs move to flat fees
On the Part D side, sponsors would have to limit PBM pay to flat-dollar, fair-market-value "bona fide service fees" that cannot be tied to drug price, rebates, or formulary placement, with fair market value defined as the cost of the itemized service plus a reasonable markup. Any payment that breaks the rule flows back from the PBM to the sponsor, and from the sponsor to CMS. CMS says it doesn't yet have sufficient data on PBM contract structures to estimate the financial impact, which tells you how opaque the current arrangements are.
6. $0 generics for the lowest-income duals
For plan years before 2028, generic copayments for full-benefit dual-eligibles at or below 100% of the federal poverty level are subject to a $1 statutory limit; from 2028 they drop to $0. CMS estimates about 6 million enrollees would be affected. Small per-fill, meaningful for adherence in exactly the population where it matters most.
What this means for agents
Every one of these provisions makes a good agent more valuable, because every one adds something a member needs to explain: what the grade means, why a provider is flagged, what ownership disclosure implies, and, most importantly, how to invoke the cost-sharing protection when a surprise out-of-network bill arrives. I expect the best agents to become practiced advocates in that process, pulling the booking date, requesting the archived directory snapshot, and holding the carrier to in-network cost sharing.
One practical caution for agents still working from paper. The protection keys off what the online directory displayed on the appointment date. A printed directory from six months ago won't carry that weight. Use the current PDF or printable electronic version from the carrier's site, and date it.
Timeline
Comments close December 15, 2026, 5:00 p.m. Eastern, under docket CMS-2026-2533. Verification, accuracy reporting, and cost-sharing protections take effect for contract year 2028; public grades follow in 2029. CMS says a separate Part C/D policy rule is expected later this fall. For plans, that means verification infrastructure and provider contract amendments need to be live by late 2027. For PBM contracts, every spread and percent-of-WAC fee has to be renegotiated before CY2028 bids are due in June 2027.