Adequacy is a living target.
CMS, state DOIs, and federal exchange rules — what passed last review fails the next, and how to build a network that anticipates the diff.
The most common misconception in provider network management is that adequacy is a state you achieve. You hit the CMS thresholds, you pass the review, and the network is adequate. Done.
It is not done. Adequacy is a condition you maintain — continuously, against standards that change on a regulatory calendar you do not control, in a provider population that turns over, retires, relocates, and loses active hospital privileges on a schedule that has nothing to do with your submission dates. The plans that treat adequacy as a pass/fail checkpoint are the ones that fail the next review.
What “adequate” actually means, and to whom
Network adequacy standards come from at least three sources simultaneously, and they do not always agree:
- CMS (for Medicare Advantage and Marketplace plans) publishes time-and-distance standards by specialty and by county type: Large Metro, Metro, Micro, Rural, and Counties with Extreme Access Considerations (CEAC). For Medicare Advantage, the standards are set at 42 CFR 422.116 and the annual HSD Reference File. The CY2024 rule added clinical psychology and clinical social work as specialty types and codified appointment wait-time standards. The CY2025 rule added Outpatient Behavioral Health. Plans that modeled adequacy against 2022 standards had new specialty types to fill, not because they lost providers, but because the standard moved.
- State Departments of Insurance (DOI) maintain their own adequacy requirements for Medicaid managed care and commercial plans, including Marketplace plans. For Medicare Advantage, CMS standards override state rules; the state still licenses the plan, but its adequacy standards apply to your other products. State rules can be more prescriptive than CMS in some areas and looser in others. They can also require appointment-access audits, secret shopper validation, and annual provider directory submissions that CMS does not. Operating in multiple states means tracking multiple regulatory calendars simultaneously.
- Accrediting bodies— NCQA, URAC, and AAAHC — layer their own adequacy and access standards on top of regulatory minimums for plans seeking or maintaining accreditation. NCQA's Network Certification program, for example, requires documented time-and-distance analysis, appointment availability standards, and an annual network adequacy plan. Accreditation surveys are scheduled in advance, but the standards against which you're measured can change between application and survey.
Where networks actually fall short
Adequacy failures at submission time are rarely about the wrong strategy. They are almost always operational. Here are the patterns we see repeatedly:
Provider attrition is not tracked in real time. A provider who terminates their contract, retires, moves to a competing plan, or loses hospital privileges should trigger an immediate adequacy re-check for their county and specialty. In practice, this information often reaches the network management team weeks or months after the fact — through a complaint, a directory audit, or a CMS corrective action notice. By then, the gap has existed long enough to affect members.
The adequacy model doesn't match the regulatory model. CMS runs its own calculation, measuring from a sample of beneficiary locations in each county and applying the standard for that county's type. States use their own methods for the products they regulate. Plans sometimes model adequacy using internal tools that don't replicate the regulatory calculation exactly. They pass their internal check and fail the CMS review because the two calculations disagree by a mile in a rural county.
Specialty gaps are treated as lower priority than PCP gaps. CMS has been adding to the specialty list, mostly in behavioral health, and every new specialty type is another county-by-county test the network has to pass. Plans that historically managed to PCP adequacy and tolerated specialty gaps are finding those gaps harder to defend.
Provider data is stale.An adequate network on paper can be an inadequate network in practice if the providers in the directory are not actually accepting new patients, are not credentialed at the locations listed, or have moved. For Medicare Advantage, directory obligations come from CMS's own rules, including 42 CFR 422.120, and the REAL Health Providers Act, enacted in February 2026, adds new MA directory requirements starting in plan year 2028. The No Surprises Act's directory rules apply to commercial and Marketplace plans, not MA, and states audit directories for the products they regulate.
Building a network that anticipates the next review
The operational posture that prevents adequacy surprises is straightforward in principle and requires consistent discipline in practice:
Run the adequacy model monthly, not annually. The adequacy model should be a living document — updated every 30 days with current provider file data, current CMS or state standards, and flagged whenever a provider termination is processed. Any month where a county drops below adequacy threshold should trigger an immediate gap-filling process, not a note in the next quarterly review.
Track the regulatory calendar explicitly. CMS Advance Notice and Rate Announcement, bid submission deadline, state DOI annual filings, accreditation survey windows — these dates belong on the network management calendar alongside the contracting and credentialing deadlines. The adequacy model should be locked to a version that matches the standards in effect for the relevant submission, not the current-year standards.
Know your exception counties and manage them separately. CMS grants exceptions where the providers it expects you to use aren't actually available (retired, not contracting with any plan, exclusive to a competitor) and your network matches the Original Medicare pattern of care. That comes up most in Rural and CEAC counties, but exceptions aren't limited to them. CMS generally won't accept an inability to reach terms as the reason. Plans that rely on exceptions without keeping the evidence current find out at review that the exception no longer holds or was never formally granted.
Build the contracting pipeline around adequacy gaps, not provider volume. A pipeline of 200 providers that adds density in already-adequate counties while leaving rural specialty gaps unfilled is not a well-managed pipeline. The target list should be driven by the adequacy model — ranked by which providers, in which counties, would most improve the adequacy score if contracted.
The adequacy conversation at the diagnostic
In every network engagement, the adequacy conversation happens in the first two weeks. We pull the current provider file, run it against the applicable standards (CMS, state DOI, or both), and produce a gap map: which counties are adequate, which are borderline, which are failing, and which are at risk of failing if we lose one or two providers. That map drives the contracting target list for the rest of the build.
The gap map also surfaces the regulatory calendar risk. If the plan is submitting to CMS in February, the network has to be adequate on paper by then. That means contracts need to be signed (or, for an applicant, covered by a letter of intent signed by both parties) by a date that works backward from the submission, and credentialing has to finish before January 1 so those providers can see members. Plans that start this calculation in the fall for a February submission are usually too late to close specialty gaps in rural markets.
What passed last review fails the next — not because the network got worse, but because the standard moved. The only defense is running the current regulatory model against live provider data, continuously.
Adequacy is not a project. It is an operating discipline. The firms and plans that treat it that way don't get surprised by CMS. The ones that treat it as an annual compliance exercise usually do, eventually.
Sources: 42 CFR 422.116 (county types, specialty standards, exceptions); CMS network adequacy guidance, December 2024; 42 CFR 422.402 (federal preemption of state law); 42 CFR 422.120 (MA provider directory information); CMS No Surprises Act overview.