Adequacy is a living target.

The most common misconception in provider network management is that adequacy is a state you achieve. You hit the CMS thresholds, you pass the review, and the network is adequate. Done.

It is not done. Adequacy is a condition you maintain — continuously, against standards that change on a regulatory calendar you do not control, in a provider population that turns over, retires, relocates, and loses active hospital privileges on a schedule that has nothing to do with your submission dates. The plans that treat adequacy as a pass/fail checkpoint are the ones that fail the next review.

What “adequate” actually means, and to whom

Network adequacy standards come from at least three sources simultaneously, and they do not always agree:

• CMS (for Medicare Advantage and Marketplace plans) publishes time-and-distance standards by plan type, county designation (urban, suburban, rural, rural exception), and specialty. These standards are updated annually in the draft Call Letter and finalized before the bid submission window. The 2024 rule materially tightened standards for several specialties and extended the appointment-wait time requirements. The 2025 rule extended those changes further. Plans that modeled adequacy against 2022 standards discovered in 2024 that their network was no longer compliant — not because they lost providers, but because the standard moved.
• State Departments of Insurance (DOI) maintain their own adequacy requirements for Medicaid managed care, commercial Marketplace plans, and in some states, all licensed health plans regardless of line of business. State rules are frequently more prescriptive than CMS requirements in urban counties and more lenient in rural ones. They can also require appointment-access audits, secret shopper validation, and annual provider directory submissions that CMS does not. Operating in multiple states means tracking multiple regulatory calendars simultaneously.
• Accrediting bodies— NCQA, URAC, and AAAHC — layer their own adequacy and access standards on top of regulatory minimums for plans seeking or maintaining accreditation. NCQA's Network Certification program, for example, requires documented time-and-distance analysis, appointment availability standards, and an annual network adequacy plan. Accreditation surveys are scheduled in advance, but the standards against which you're measured can change between application and survey.

Where networks actually fall short

Adequacy failures at submission time are rarely about the wrong strategy. They are almost always operational. Here are the patterns we see repeatedly:

Provider attrition is not tracked in real time. A provider who terminates their contract, retires, moves to a competing plan, or loses hospital privileges should trigger an immediate adequacy re-check for their county and specialty. In practice, this information often reaches the network management team weeks or months after the fact — through a complaint, a directory audit, or a CMS corrective action notice. By then, the gap has existed long enough to affect members.

The adequacy model doesn't match the regulatory model. CMS and state DOIs use specific geographic methodologies — driving-time calculations using specific software, population centroid definitions, county designation thresholds. Plans sometimes model adequacy using internal tools that don't replicate the regulatory calculation exactly. They pass their internal check and fail the CMS review because the two calculations disagree by a mile in a rural county.

Specialty gaps are treated as lower priority than PCP gaps. CMS has tightened specialty adequacy requirements significantly over the past three contract years, particularly for behavioral health, oncology, and cardiology. Plans that historically managed to PCP adequacy and tolerated specialty exceptions are finding that those exceptions are no longer acceptable.

Provider data is stale. An adequate network on paper can be an inadequate network in practice if the providers in the directory are not actually accepting new patients, are not credentialed at the locations listed, or have moved. CMS has increased scrutiny of directory accuracy under the No Surprises Act requirements, and state audits of directory accuracy have become more frequent across the board.

Building a network that anticipates the next review

The operational posture that prevents adequacy surprises is straightforward in principle and requires consistent discipline in practice:

Run the adequacy model monthly, not annually. The adequacy model should be a living document — updated every 30 days with current provider file data, current CMS or state standards, and flagged whenever a provider termination is processed. Any month where a county drops below adequacy threshold should trigger an immediate gap-filling process, not a note in the next quarterly review.

Track the regulatory calendar explicitly. CMS Call Letter release, bid submission deadline, state DOI annual filings, accreditation survey windows — these dates belong on the network management calendar alongside the contracting and credentialing deadlines. The adequacy model should be locked to a version that matches the standards in effect for the relevant submission, not the current-year standards.

Know your rural exception counties and manage them separately. CMS provides rural exception processes for counties where meeting the standard time-and-distance requirements is demonstrably impossible given the available provider population. Applying for and maintaining these exceptions requires documentation — a community need justification, alternative access mechanisms, and a corrective action plan. Plans that rely on rural exceptions without maintaining the documentation for them find out at review that the exception has expired or was never formally granted.

Build the contracting pipeline around adequacy gaps, not provider volume. A pipeline of 200 providers that adds density in already-adequate counties while leaving rural specialty gaps unfilled is not a well-managed pipeline. The target list should be driven by the adequacy model — ranked by which providers, in which counties, would most improve the adequacy score if contracted.

The adequacy conversation at the diagnostic

In every network engagement, the adequacy conversation happens in the first two weeks. We pull the current provider file, run it against the applicable standards (CMS, state DOI, or both), and produce a gap map: which counties are adequate, which are borderline, which are failing, and which are at risk of failing if we lose one or two providers. That map drives the contracting target list for the rest of the build.

The gap map also surfaces the regulatory calendar risk. If the plan is submitting to CMS in March, we need to be adequate in February — which means contracts need to be signed and credentialing needs to be complete by a date that works backward from the February adequacy snapshot. Plans that start this calculation in December for a March submission are usually too late to close specialty gaps in rural markets.

What passed last review fails the next — not because the network got worse, but because the standard moved. The only defense is running the current regulatory model against live provider data, continuously.

Adequacy is not a project. It is an operating discipline. The firms and plans that treat it that way don't get surprised by CMS. The ones that treat it as an annual compliance exercise usually do, eventually.