What CMS actually looks for in a network adequacy filing.

CMS network adequacy review is not a checkbox exercise. Reviewers are looking at actual provider files, running their own time-and-distance calculations, and comparing your submission against their internal provider databases. Plans that submit without understanding the review criteria get requests for information. Plans that get too many RFIs miss deadlines.

The organizations that navigate the review cleanly have done one thing consistently: they have run their own analysis against CMS standards before submitting, not after. They know where their gaps are. They have documented exceptions. Their provider data is clean. The review is still a review — but it's not a discovery process.

Here is what the submission actually contains and what reviewers look for in each piece.

What's in a network adequacy submission

CMS requires specific data elements for each component of the submission. Incomplete files are rejected or flagged immediately. The required elements:

• Provider and facility HSD tables. Every contracted provider and facility, with National Provider Identifier (NPI), the CMS HSD specialty code and the address where they see patients. Applicants flag any provider covered by a letter of intent in the LOI column. These tables are machine-readable, and CMS runs automated checks against them. Format matters.
• Time and distance, calculated by CMS. CMS calculates time and distance itself from your HSD tables and returns pass or fail results by county and specialty. You don't submit your own analysis, but you should replicate CMS's result before you upload.
• Adequacy attestation. A signed declaration from an authorized organizational representative — typically the CEO or COO — affirming that the network meets applicable standards. This is a legal attestation. The person signing it is personally attesting to the accuracy of the submission.
• County-level exception requests with supporting documentation. For any county and specialty combination where you cannot meet CMS standards, you must request an exception and document why.

What CMS reviews — and what triggers RFIs

CMS reviewers have access to NPPES (the National Plan and Provider Enumeration System) and other federal provider databases. Every NPI in your submission gets cross-referenced. The most common RFI triggers:

NPI validation failures. Inactive NPIs, NPIs whose NPPES taxonomy doesn't match the HSD specialty you filed, practice addresses that differ significantly from what NPPES shows — all of these flag. Before you submit, run every NPI in your provider file against the NPPES database and reconcile discrepancies. This is manual work, but it is the single most reliable way to avoid NPI-related RFIs.

Provider counts below adequacy thresholds. Alongside time and distance, CMS sets a minimum number of providers for each specialty in each county, based on a ratio per 1,000 beneficiaries. If your county-level provider counts fall below those thresholds, you need a documented exception — not just a note in the filing. If CMS can count your in-network providers in a county and determine you're below the standard, they will.

A gap between your model and CMS's result. CMS runs the time-and-distance calculation with its own methodology and returns the results. It doesn't take your numbers. The risk is that your internal model told you a county passes and CMS's result says it doesn't. Model from beneficiary distribution within each county, not county centroids, because that is how CMS measures. And don't treat straight-line radius circles as a stand-in for travel time; they overstate coverage wherever roads, rivers or terrain get in the way.

Accepting-new-patients status. CMS's network adequacy guidance doesn't spell out a rule that drops providers with closed panels from the count, but closed panels still matter. In markets where established PCPs aren't taking new patients, a network that passes on paper can still leave members without appointments, and your directory has to show panel status accurately. Know your open-panel numbers by county and specialty.

Contract effective dates. For applicants, contracts effective January 1 of the contract year count, and during the application review a letter of intent signed by both parties can stand in for the contract. For an existing plan's triennial review, the contract has to be in force. Either way, a provider who isn't credentialed by January 1 can't see your members. Plan credentialing timelines accordingly.

Exception documentation

CMS allows exceptions where the providers it expects you to use aren't actually available, in any county type, not only rural ones. Exceptions are legitimate tools. They exist because some markets genuinely can't support the standard, but they require specific documentation.

An acceptable exception request shows two things: that the providers CMS lists aren't actually available (retired, not contracting with any plan, exclusive to a competitor), and that your network matches the Original Medicare pattern of care in that county. CMS will generally not accept an inability to reach terms with available providers as a reason.

Exceptions are not guaranteed. CMS can deny an exception, which leaves you with a deficiency to close by adding providers.

One practical note on exception documentation: the evidence needs to be specific. A general statement that “there are no available orthopedic surgeons in County X” is not sufficient. Name the providers CMS's supply data shows in or near that county and say, for each one, why they aren't available. Dated outreach records help make that case. Build the exception documentation as you go; recreating it at submission time from memory is much harder.

Every NPI in your submission is a data point CMS can check. Submit clean data or plan for an RFI.

Run your own adequacy analysis against CMS thresholds before you submit — not after. The time to find gaps is during the build, when you have weeks to address them, not at the submission deadline when you have days. Every network build we run includes monthly adequacy analysis from the first week of contracting. The goal is to arrive at submission with no surprises — and with exception documentation that's already written, dated, and organized.

Sources: 42 CFR 422.116 (time and distance, minimum provider counts, letters of intent, exceptions); CMS network adequacy guidance, December 2024 (sections 4.1, 4.2).