What the CMS 2026 MA Final Rule Means for Your Network

What did the CY2026 MA final rule actually finalize?

The April 2025 final rule finalized a defined set of provisions, most of them touching benefits and drug administration rather than network design directly. CMS eliminated cost-sharing on covered insulin products and on adult vaccines recommended by the Advisory Committee on Immunization Practices, codified the Medicare Prescription Payment Plan with automatic renewal and tighter processing timelines, shortened Prescription Drug Event submission windows, and clarified that inpatient coverage decisions made before, during, or after care are formal organization determinations carrying appeal rights. It also restricted certain Special Supplemental Benefits for the Chronically Ill and mandated integrated member ID cards for applicable integrated dual-eligible plans.

For network owners, the single most consequential finalized item is not in that April list at all — it is the provider directory and Medicare Plan Finder requirement CMS finalized in September 2025. That is the provision that changes what your directory data has to do and how quickly it has to change. Everything else in the finalized package either lives adjacent to your network work or shapes the benefit design your contracted providers deliver. Knowing which bucket a provision falls into keeps your team from over-building against benefit rules while a real directory obligation goes unstaffed.

The provider directory and Medicare Plan Finder rule you cannot ignore

Finalized in the September 19, 2025 rule on formatting provider directories for Medicare Plan Finder, this provision does three things that land squarely on your operations. First, MA organizations must attest to the accuracy of their provider directory data. Second, they must make that data available to CMS so it can populate the Medicare Plan Finder comparison tool that beneficiaries use to shop plans. Third, they must update the data CMS draws on no later than 30 days after being notified of a change in a provider's information. CMS set January 1, 2026 as the date by which MA organizations make their directory data available, with the rule effective November 17, 2025 and applicable beginning January 1, 2026.

The strategic shift here is that your directory stops being a document you file and becomes a live feed CMS republishes to the public. When a member compares plans on Medicare Plan Finder and picks yours because a particular cardiologist appears in-network, that provider had better be contracted, credentialed, and accepting patients. A stale entry is no longer a private embarrassment buried in a PDF — it is a public representation CMS is surfacing on your behalf, and it is exactly the kind of gap that fuels ghost-network complaints. We walk through why these lists drift and how to stop it in directory accuracy isn't optional and ghost networks.

The 30-day update clock is the operational teeth. Provider information changes constantly — a practice closes a location, a physician leaves a group, a panel closes to new patients — and each change starts a countdown. Meeting it reliably is a provider-data-operations problem, not a once-a-year filing task, and it is one of the clearest reasons builds that treat directory maintenance as clerical work fall behind. The discipline required is the subject of provider data operations.

What CMS deferred: behavioral health and network adequacy

Just as important as what was finalized is what was not. In the April 2025 final rule, CMS declined to finalize proposals to establish stricter behavioral health parity protections or to expand network adequacy standards, stating those items remain under review. It did not finalize the additional directory proposals that would have reached community-based organizations and in-home service contractors. It did not finalize guardrails on the use of artificial intelligence, including AI in prior authorization, though it acknowledged strong stakeholder interest and signaled possible future rulemaking. And several health-equity initiatives, including the Health Equity Index reward, were left under administrative review.

For planning purposes, treat these as delayed rather than dead. CMS repeatedly used the language of future rulemaking, which means the proposals are parked, not buried, and a subsequent contract year rule can revive any of them. The prudent posture is to build a network that would comfortably clear the tighter behavioral health and adequacy expectations CMS proposed, without wiring hard compliance triggers to obligations that have no effective date yet. Over-building against a deferred rule wastes capital; ignoring the direction of travel invites a scramble when it returns. The Health Equity Index in particular is worth tracking now because of its Star Ratings linkage, which we take up in the Health Equity Index and your 2027 Star Ratings.

Behavioral health access is still tightening — just not through this rule

It would be a mistake to read the deferral of behavioral health parity as a reprieve on behavioral health adequacy. The pressure on behavioral health networks did not begin with the CY2026 proposal and does not end with its deferral. CMS already added an outpatient behavioral health provider type to the Medicare Advantage network adequacy standards in an earlier contract year rule, subject to time-and-distance and minimum-number requirements, with a telehealth credit that acknowledges how these services are increasingly delivered. That standard is in force regardless of what CY2026 did or did not finalize.

So the behavioral health question for your network is not whether a new rule forced your hand — it is whether you can pass the adequacy tests already on the books while demand for these services keeps climbing. Recruiting psychiatrists, psychologists, licensed clinical social workers, and substance use disorder providers into contracted, credentialed status remains one of the hardest parts of any MA build, and the deferral changes none of that. We cover the mechanics in behavioral health adequacy and the evolving federal expectations in behavioral health network adequacy: the new CMS standards. How CMS actually scores those time-and-distance tests is the subject of how CMS measures time and distance.

What this means for your directory operations

The finalized directory rule converts a periodic compliance chore into a continuous data-quality obligation, and the organizations that struggle will be the ones still running directories out of spreadsheets and email threads. To meet a 30-day update standard while feeding accurate data to Medicare Plan Finder, you need a single source of truth for provider status, a defined intake for changes, and a closed loop that confirms every reported change is reflected in the data CMS pulls. That is a workflow with owners and service levels, not a quarterly cleanup.

It also raises the stakes on the upstream work that makes directory accuracy possible: disciplined credentialing, clean provider records, and tight coordination between contracting and data teams. A directory can only be as accurate as the credentialing and roster processes feeding it, which is why we treat credentialing and provider data as one connected system rather than two departments. The practical checklist below is where most teams should start.

• Establish a single source of truth for provider status that both your directory and your CMS feed draw from.
• Define a change-intake process with a documented 30-day clock from notification to publication.
• Reconcile your directory against contracted-and-credentialed rosters on a fixed cadence, not on complaint.
• Assign named owners and service levels for directory updates — accountability, not good intentions.
• Audit Medicare Plan Finder representations the way you would audit a filing, because CMS now surfaces them publicly.

The compliance calendar: which dates actually matter

Anchor your planning to a small set of confirmed dates. The main CY2026 final rule was issued April 4, 2025. The provider directory and Medicare Plan Finder rule was published September 19, 2025, effective November 17, 2025, and applicable beginning January 1, 2026, with MA organizations required to make directory data available to CMS by January 1, 2026 and to update it within 30 days of notice of a change thereafter. Everything CMS deferred — behavioral health parity, network adequacy expansion, AI guardrails — has no effective date and should be tracked as pending rather than scheduled.

Layer those dates onto the broader application and filing rhythm that governs any MA network. Directory readiness for January 1 does not stand alone; it sits inside the annual cycle of network adequacy submissions, application milestones, and service-area decisions that we map in the CMS application calendar and network adequacy filing. Missing the interaction between a directory deadline and a filing window is how an otherwise healthy build stumbles at the worst possible moment.

What to do now

The correct response to the CY2026 rule is neither panic nor complacency — it is disciplined sequencing. Stand up the directory and Medicare Plan Finder capability first, because it has real dates and public exposure. Keep building behavioral health and overall adequacy to a standard that would clear the deferred proposals, because the direction of federal expectation is clear even where the effective dates are not. And treat the deferred items as a watch list, reviewing each subsequent contract year rule for their return so you are configuring ahead of a deadline rather than reacting to one.

This is exactly the kind of work where an experienced guide earns their place. Kearny Street Management builds, repairs, and runs provider networks against precisely these calendars — separating finalized obligations from proposals, wiring directory operations that survive a 30-day clock, and keeping behavioral health and adequacy ahead of the standard rather than behind it. If you want a read on where your network stands against the CY2026 rule, see our services or talk to our team. The rule is fixed; how prepared you are for it is still a choice.