The Medicaid Access Rule: Wait-Time Standards Are Coming

What is the Medicaid Access Rule?

The Access Rule is one of two companion regulations CMS finalized in 2024 to strengthen access to care across Medicaid. The managed care piece, CMS-2439-F, is the one that matters most for network owners because the vast majority of Medicaid enrollees are in managed care. It strengthens standards for timely access, tightens states' monitoring and enforcement obligations, adds fiscal and program-integrity requirements for state directed payments, specifies in-lieu-of services, refines medical loss ratio rules, and establishes a quality rating system so members can compare plans. You can read CMS's own summary in the CMS-2439-F fact sheet and the full landing page on Medicaid.gov.

For provider-network leaders, four provisions carry the weight: enforceable appointment wait-time standards, independent secret-shopper surveys, an annual enrollee experience survey, and a payment analysis that puts Medicaid rates on public display against Medicare. Each one turns a piece of network work that used to be internal into something an outside party can measure and publish. Medicaid adequacy has always differed from Medicare Advantage in structure and enforcement, a contrast we draw out in Medicaid vs. Medicare Advantage network; the Access Rule narrows that gap by importing the kind of appointment-availability testing plans associate with commercial and MA scrutiny.

The wait-time standards, exactly

The rule establishes maximum appointment wait-time standards for routine services, measured in business days from the date of the enrollee's request. States must enforce these as a floor and may set tighter timeframes if they choose. The thresholds are specific, and they are the numbers your recruitment and contracting plan now has to design around.

Critically, compliance is not a pass-fail on a single call. States must demonstrate, through the secret-shopper surveys described below, that plans meet the standard at a rate of at least 90 percent of appointments. That 90 percent bar is what converts these thresholds from aspirational language into an operational target: your network has to produce timely appointments the overwhelming majority of the time, not just on paper and not just for your easiest-to-reach providers.

• Routine primary care, adult and pediatric: no more than 15 business days from the date of request.
• Routine obstetric and gynecological (OB/GYN) services: no more than 15 business days from the date of request.
• Outpatient mental health and substance use disorder services, adult and pediatric: no more than 10 business days from the date of request.
• A fourth service type selected by each state: threshold set by the state.
• Compliance measured at a rate of at least 90 percent of appointments meeting the applicable standard.

Secret-shopper surveys: your directory becomes evidence

To verify those standards, the rule requires states to engage an independent entity — one that is not part of the state Medicaid agency and not one of the plans being surveyed — to conduct annual secret-shopper surveys. Shoppers pose as enrollees or their representatives and attempt to schedule appointments with providers listed in the plan's directory. The surveys do double duty: they measure whether the wait-time standards are actually met, and they validate the accuracy of the provider directory itself, covering primary care, OB/GYN, and outpatient behavioral health providers.

This is where a great many networks will discover their real adequacy. A directory full of providers who have moved, retired, closed their panels, or never accepted the plan in the first place will fail a secret-shopper survey no matter how clean the time-and-distance map looks. That failure mode is the classic ghost network, and the Access Rule effectively deputizes an auditor to find it. We describe how these phantom entries accumulate and how to purge them in ghost networks and directory accuracy isn't optional.

The defense is unglamorous and continuous: keep your directory synchronized with your contracted-and-credentialed roster, confirm appointment availability rather than assuming it, and treat every reported change as a data event with an owner and a deadline. That is provider-data operations as a standing function, not a project, and it is the subject of provider data operations. Clean upstream credentialing and roster data are what make a directory survivable under a shopper's phone call, which is why credentialing and directory accuracy have to be run as one system.

Telehealth counts — but only if you also have in-person access

The rule takes a deliberate position on remote appointments so that plans cannot paper over in-person shortages with a telehealth vendor. States may count telehealth appointments toward the wait-time standards, but generally only where the provider furnishing the telehealth visit also offers in-person services — unless the state has its own law requiring coverage parity regardless of modality. In practice, that means you cannot satisfy the standard by contracting with a telehealth-only company and calling the network adequate; you need enough in-person capacity to meet the thresholds on its own terms, with telehealth extending access rather than substituting for it.

This mirrors the direction of travel across programs, where telehealth is credited as a supplement to physical network capacity rather than a replacement for it. The interplay between virtual access and adequacy math is worth understanding in detail, and we cover it in telehealth network adequacy. For behavioral health in particular — where the 10-business-day standard is tightest and in-person supply is thinnest — the temptation to lean on telehealth is greatest and the rule's guardrail bites hardest. Building genuine behavioral health capacity is the harder, and correct, answer; see behavioral health adequacy and behavioral health network adequacy: the new CMS standards.

Payment analysis: your Medicaid rates, in public, against Medicare

The Access Rule also requires states to publish an annual payment analysis comparing what managed care plans pay for key services — primary care, OB/GYN, mental health, and substance use disorder — expressed as a percentage of the corresponding Medicare rates. Those comparisons feed into the state's publicly posted network adequacy and access assurances reporting. The logic is direct: CMS believes access problems are often payment problems, and putting rate ratios on public display is meant to expose networks that are technically staffed but priced too low to actually deliver appointments.

For network builders, this reframes the fee-schedule conversation. Rates you set for adequacy purposes are no longer a private negotiation; they become a data point regulators, advocates, and providers can see and compare. If your behavioral health rates sit far below Medicare, a thin and unresponsive behavioral network is the predictable result, and now the payment analysis will connect those dots for anyone watching. We work through how to benchmark and defend these decisions in fee-schedule benchmarking and how time-and-distance scoring interacts with real capacity in how CMS measures time and distance.

Enrollee experience surveys and remedy plans

Two more provisions close the enforcement loop. States must conduct an annual enrollee experience survey for each managed care plan, capturing members' actual experience of getting care rather than only the structural measures of the network. And when a plan fails to meet the access standards, the state must require a remedy plan — a documented, time-bound corrective action to close the identified gaps. Together with the quality rating system that lets members compare plans on a public platform, these turn access from a filing you submit into an outcome you are held to over time.

The message for risk-bearing organizations is that adequacy has become a living target rather than an annual snapshot. A network that clears the standards this year can drift out of compliance through ordinary provider attrition, and the surveys and remedy-plan machinery are designed to catch that drift. Managing it is continuous work, which we frame in adequacy as a living target and provider attrition and adequacy.

The compliance timeline: what happens when

The rule phases in deliberately, and the sequencing tells you where to spend effort first. The maximum appointment wait-time standards apply for the first rating period beginning on or after July 9, 2027. The independent secret-shopper surveys apply for the first rating period beginning on or after July 10, 2028 — deliberately set one year after the wait-time standards so that the first surveys have a standard to measure against. Directory and access reporting improvements phase in earlier, and the payment-analysis and network-adequacy reporting requirements land on their own applicability dates ahead of the shopper surveys. CMS published an applicability-dates chart alongside the fact sheet precisely because the provisions do not all start together.

Read that timeline as a runway, not a reprieve. Recruiting behavioral health providers, renegotiating rates that will show up in a public payment analysis, and rebuilding directory operations to survive an independent audit are not tasks you complete in the quarter before a deadline. Plans and IPAs that start in 2026 will meet the 2027 and 2028 dates comfortably; those that wait will be recruiting under a clock and cleaning directories under a shopper's scrutiny at the same time. The broader filing rhythm this fits into is mapped in network adequacy filing.

What plans and IPAs must do now

Start with the two provisions that will expose you publicly: appointment access and directory accuracy. Audit whether your current network can actually produce appointments inside 15 business days for primary care and OB/GYN and 10 for outpatient behavioral health, at a 90 percent rate — not on the map, but on the phone. Where it cannot, prioritize recruitment and rate adjustments in the specialties and geographies that fail, and stand up the provider-data operations that keep a directory synchronized with reality between filings. For organizations still maturing their risk infrastructure, the readiness work overlaps heavily with what we outline in IPA risk readiness.

This is precisely the terrain Kearny Street Management works in: building, fixing, and running provider networks against hard regulatory calendars. We stress-test networks the way a secret shopper will, close behavioral health and access gaps before an auditor finds them, and turn directory maintenance into a function that holds up under independent review. If wait-time standards, secret-shopper surveys, and public payment analyses are on your horizon, see our services or talk to our team. The standards are coming on a fixed schedule — the advantage goes to the plans that build for them early.