Managed care is the dominant delivery system for Medicaid enrollees with 72% of Medicaid beneficiaries nationally enrolled in comprehensive managed care organizations (MCOs). Current federal rules require states to establish and enforce network adequacy standards for Medicaid MCOs, but states have flexibility to define those standards. States use an array of provider network standards (e.g., time and distance, provider-to-enrollee ratios, and appointment wait time) as well as varying methods to monitor access and oversee MCO performance. Recent research findings suggest that provider network directories may overstate Medicaid physician availability and current network adequacy standards may not reflect actual access. It is well documented that provider directories are often outdated or inaccurate. Study findings also suggest care provided to Medicaid enrollees is often highly concentrated among a small number of physicians. Our KFF Survey of Consumer Experiences with Health Insurance revealed adults with Medicaid or Marketplace coverage are more likely than those with Medicare or employer sponsored insurance to report experiencing provider network problems.
On April 27, 2023, the Biden Administration released two notices of proposed rulemaking (NPRMs), Ensuring Access to Medicaid Services (“Access” NPRM”) and Managed Care Access, Finance, and Quality (“Managed Care” NPRM), to help ensure access to quality health care in Medicaid and the Children’s Health Insurance Program (CHIP). Under the Managed Care NPRM, CMS is proposing to establish national maximum wait time standards for certain appointments and to require states to conduct independent secret shopper surveys to validate plan compliance. States would also be required to conduct an annual enrollee experience survey and managed care plan payment analysis for certain services.
This brief describes current network adequacy and availability standards for Medicaid managed care plans, presents related findings from KFF’s 22nd annual Medicaid budget survey (conducted in 2022), and summarizes proposed changes to network adequacy and access rules in the Managed Care NPRM. The 2022 Medicaid budget survey asked states about network access and availability monitoring, network adequacy penalties, and about certain features of state-developed standards. Findings from the survey may provide information and context for provisions included in the Managed Care NPRM. Public comments (for both NPRMs) are due by July 3, 2023. Key findings from our 2022 survey include:
Federal law requires Medicaid managed care plans to assure that they have capacity to serve expected enrollment in their service area and maintain a sufficient number, mix, and geographic distribution of providers. A Medicaid managed care plan must make covered services accessible to its enrollees to the same extent that such services are accessible to other state residents with Medicaid who are not enrolled with that plan.
Network adequacy standards for Medicaid managed care plans differ by state. While federal rules related to availability of services are complex, key requirements for network adequacy (i.e., whether managed care plans contract with a sufficient number of providers to serve enrollees) include the following:
Plans must document to the state that they have the capacity to serve the expected enrollee population. This must occur annually (in addition to at contract start) as well as when there are significant changes in a plan’s operations that affect its capacity. Significant changes include changes that affect the plan’s covered services or geographic service area, the composition of payments to its provider network, or enrollment of a new population. States, in turn, must assure CMS that the plans meet the state’s requirements for availability of services and provide an analysis that supports the state’s certification of each plan’s provider network adequacy. As of October 2022, states are required to use a standard reporting template. CMS plans to make the Network Adequacy and Access Assurances Reports publicly available on Medicaid.gov once a page is established and CMS has completed an initial review of the reports but will make these reports available upon request until then.
States must monitor managed care plan performance, including the availability and accessibility of services (including network adequacy standards). Each state Medicaid agency must have a monitoring system for all managed care programs. The monitoring system must address all aspects of the state’s managed care program, including the performance of each managed care entity in virtually every area of operations and management (e.g., appeals and grievance systems, claims management, enrollee materials and customer service, information systems, marketing, medical management, provider network management, availability and accessibility of services). States and managed care plans may use multiple datasets to monitor network adequacy and access (e.g., MCO-supplied data and reports, administrative or claims data, survey data, etc.). A 2018 MACPAC study found few states referenced metrics or standards to measure access or network adequacy and most states describe network oversight in terms of contract compliance and access monitoring in terms of visits or clinical outcomes.
States that contract with managed care plans must ensure that a qualified “external quality review organization” (or EQRO) performs an annual external quality review (EQR) for each plan. EQR activities are intended to improve states’ ability to oversee and manage the managed care plans they contract with, and help managed care plans improve performance. The primary focus of EQR annual reviews is on quality outcomes and timeliness of and access to services. Validation of plan network adequacy is a mandatory EQR activity. In February 2023, CMS released updated EQR protocols which add a new protocol for the mandatory network adequacy validation activity. States and EQROs must begin using the new network adequacy validation protocol by February 2024. States are required to finalize and post the annual EQR technical report on their website. A recent MACPAC review revealed EQR annual technical reports are sometimes difficult to locate and may be hard for stakeholders to understand (e.g., may be lengthy, technical, and/or report only aggregate results etc.).
Beginning in June 2021, states were required to submit the Managed Care Program Annual Report (MCPAR) to CMS (no later than 180 days after each contract year) for each managed care program the state administers. The first reports were due to CMS in December 2022. The MCPAR must provide information on and an assessment of the availability and accessibility of covered services within managed care contracts, including network adequacy standards. The MCPAR must also include the results of any sanctions or corrective action plans imposed by the state (or other formal or informal intervention) with a contracted managed care plan (described in more detail below). CMS plans to make the MCPAR publicly available on Medicaid.gov once a page is established and CMS has completed an initial review of the reports but will make these reports available upon request until then.
States may impose penalties if managed care plans do not meet contractual obligations, including those related to network adequacy and access standards. States have several enforcement mechanisms including corrective action plans, monetary penalties, or terminating the plan contract. States can also suspend new enrollment after a sanction has been imposed (until the state or CMS determines the reason for the sanction has been resolved). A 2018 MACPAC study found most states do not provide specific enforcement mechanisms for failure to meet access standards or report network data.
KFF’s annual Medicaid budget survey conducted in 2022 asked states to identify network adequacy monitoring activities in place as of July 1, 2022, and penalties issued for non-compliance with network adequacy standards in the past three years. States were also asked to describe how network adequacy standards currently account for enrollee use of public transit and services delivered via telehealth as well as how cultural competency standards for provider networks are defined and enforced. Findings from the survey may provide helpful information and context for provisions included in the Managed Care NPRM.
Currently, states use a variety of methods to monitor MCO compliance with network adequacy standards and access requirements (Figure 1 and Appendix). States were asked to identify strategies used to monitor MCO network adequacy, including External Quality Review Organization (EQRO) monitoring activities, as well as other strategies in place to monitor network access and availability, as of July 1, 2022. Results from the survey show EQR organizations are engaged in a variety of network adequacy monitoring tasks. The majority of responding MCO states reported “other” monitoring (in addition to EQR monitoring) across most monitoring categories. While we did not ask states to describe their specific monitoring activities (e.g., breadth, frequency, or how findings inform quality improvement activities), these data provide a high-level snapshot of the various methods being used to track network access and availability as part of EQRO monitoring or other state activities.
A MACPAC review of publicly available state network oversight documents found that most states do not provide specific network adequacy enforcement mechanisms. A 2014 HHS Office of Inspector General report found that among states that identified violations of access standards, states most commonly relied on corrective action plans to address them. When states do impose monetary penalties on MCOs, the fines are often very small relative to annual Medicaid profits and revenues. Generally, publicly available information on states’ use of penalties has been limited to date.
Nine responding MCO states reported issuing penalties for non-compliance with MCO contractual network adequacy standards in the past three years (Table 1). States were asked whether they have issued one or more monetary or non-monetary penalties (excluding corrective action plans) for non-compliance with MCO contractual network adequacy standards attributable to MCO performance in the past three years. States reported monetary penalties, liquidated damages, suspending new enrollment, and mandating out of network access (for certain provider types or areas with deficiencies). Areas of non-compliance included failure to meet various state standards (e.g., time and distance, provider-to-member ratios, appointment wait times, accepting new Medicaid enrollees, provider directory requirements) and covered a variety of provider types (e.g., primary care, obstetrics, behavioral health, hospital, home health, vision, dental).
Only five responding MCO states reported state-developed time and distance standards account for enrollees who rely on public transit (as of July 1, 2022) (Table 2). Time and distance standards establish a maximum travel time or distance that enrollees would have to travel to see a provider in their network. The 2020 CMS Medicaid managed care final rule removed the requirement that states use time and distance standards to ensure provider network adequacy and instead lets states choose any quantitative standard. However, most MCO states establish time and distance standards as part of network adequacy requirements. Medicaid beneficiaries, particularly in urban areas, may rely on public transit rather than driving. CMS recommends states should consider how to adapt time and distance standards based on traffic patterns, car ownership, and public transportation in urban and rural areas.
While some states have not altered network adequacy requirements to account for telehealth, other states reported varying approaches to accounting for telehealth availability within network adequacy standards. States were asked how (if at all) their state MCO network adequacy requirements account for services delivered via telehealth. Among states that reported accounting for telehealth, some generally reported MCOs may use the availability of telehealth services to meet network adequacy requirements while other states reported allowing telehealth availability to be considered only under certain circumstances (e.g., for specific provider types) or as part of network adequacy “exception” requests. A few states indicated work currently underway to study this issue further.
In developing network adequacy standards, states must consider the ability of network providers to communicate with patients with limited English proficiency in their preferred language and to accommodate patients with disabilities. Plans must participate in state efforts to promote linguistically and culturally competent care. Federal rules also require Medicaid managed care plan directories to indicate providers’ cultural and linguistic capabilities and the availability of skilled medical interpreters.
Although there are no specific federal requirements, most MCO states reported they define cultural competency standards for MCO provider networks in their MCO contracts. Several states reported MCOs are required to submit an annual cultural competency plan to the state Medicaid agency. Some states reported MCOs are required to provide cultural competency training to network providers or must ensure network providers complete cultural competency training. Although states were asked how cultural competency standards are enforced, few specifically described how they monitor and ensure compliance with these standards. Those that did described activities including reviewing MCO network management plans and policies, requiring MCOs to evaluate compliance and report to the state, monitoring compliance as part external quality review, monitoring grievances and appeals, and retaining the ability to apply remedies for non-compliance (e.g., corrective action plans, enhanced monitoring, sanctions etc.). Examples of state cultural competency standards for MCO provider networks are included in Table 4 below.
On April 27, 2023, the Biden Administration released two notices of proposed rulemaking (NPRMs), Ensuring Access to Medicaid Services (“Access” NPRM”) and Managed Care Access, Finance, and Quality (“Managed Care” NPRM), to help ensure access to quality health care in Medicaid and the Children’s Health Insurance Program (CHIP) across fee-for-service and managed care delivery systems. Provisions related to network adequacy standards and availability of services in the Managed Care NPRM have been summarized below:
Under the proposed rules, states would be required to develop and enforce wait time standards for certain routine appointments. CMS proposes establishing maximum wait time standards for routine outpatient mental health and substance use disorder (SUD) appointments (no longer than 10 business days), routine primary care appointments (no longer than 15 business days), and routine OB/GYN appointments (no longer than 15 business days). CMS notes the proposed maximum timeframes were informed by standards for the individual Marketplace that will go into effect in 2024. States would also be required to establish a maximum appointment wait time standard for an additional state-selected service. CMS would defer to states on whether and how to vary appointment wait time standards for the same provider type (e.g., adult vs. pediatric, telehealth vs. in-person, geography, etc.) but all standards would need to fall within maximums proposed.
States would be required to use an independent entity to conduct annual secret shopper surveys to validate plan compliance with appointment wait time standards as well as the accuracy of provider directories. To increase the validity and accuracy of states’ efforts to measure network adequacy and access, CMS proposes to require states to use secret shopper surveys as part of their monitoring activities. States would be required to determine each managed care plan’s rate of network compliance with appointment wait time standards (proposing a minimum compliance rate of at least 90 percent). CMS proposes appointments offered via telehealth only be counted toward compliance if the provider also offers in person appointments (and that telehealth visits offered during the secret shopper survey be identified separately). CMS also proposes to require surveys of provider directory data to verify the accuracy of certain data elements (street address, telephone number, active network status with the managed care plan, and whether the provider is accepting new enrollees) for primary care, OB/GYN, outpatient mental health, and SUD providers, as well as the “state-selected” provider type. States would be required to post the results of these surveys on the state’s website. (Effective July 1, 2025, the Consolidated Appropriations Act, 2023 will require Medicaid managed care plan electronic provider directories be searchable and include information on whether each provider offers covered services via telehealth.)
To ensure states’ managed care program monitoring systems capture the enrollee experience, states would be required to conduct an annual enrollee experience survey. CMS indicates results from enrollee surveys would help states evaluate access to care and care continuity and inform the development of quality assessment and improvement strategies. CMS invites comment on whether they should mandate the use of a specific enrollee experience survey or define characteristics of acceptable survey instruments as well as related to the cost and feasibility of implementing enrollee experience surveys for each managed care program.
To better understand how payment rates may impact access, states would be required to submit an annual payment analysis comparing certain managed care provider rates to Medicare rates. Managed care plans would be required to use paid claims data from the immediate prior rating period to determine the total amount paid for primary care, OB/GYN, mental health, and SUD evaluation and management (E&M) services. The payment analysis would provide each managed care plan’s payment levels (by provider type) as a percentage of Medicare rates. Percentages would be reported separately if they differ between adult and pediatric services. States would submit a similar payment analysis for certain home and community-based services (HCBS) (homemaker services, home health aide services, and personal care services) but the comparison would be to Medicaid fee-for-service rates (due to lack of comparable Medicare rates for these services). States would be required to post this information on their website within 30 days of submission to CMS.
Under the proposed rules, states would be required to submit remedy plans to address any areas where managed care plans need to improve access. Remedy plans would identify responsible parties (including states and plans) and specific steps to achieve improvement within 12 months. States would be required to submit quarterly progress updates to CMS on implementation of the remedy plan.
Many factors influence access to care including provider supply and capacity, payment rates, accuracy of provider directories, cultural competency/provider acceptability, availability of transportation, etc. As most Medicaid beneficiaries are enrolled in comprehensive MCOs, managed care plan efforts to recruit and maintain their provider networks affect enrollees’ access to care through factors such as travel times, wait times, or choice of provider. Current federal rules require states to establish and enforce network adequacy standards for Medicaid MCOs, but states have flexibility to define those standards. States use an array of provider network standards (e.g., time and distance, provider-to-enrollee ratios, and appointment wait time) as well as varying methods to monitor access and oversee MCO performance. Historically, CMS has provided limited oversight of state access standards. Recent research findings suggest that MCO provider network directories may overstate Medicaid physician availability and current network adequacy standards may not reflect actual access. Study findings also suggest care provided to Medicaid enrollees is often highly concentrated among a small number of physicians.
On April 27, 2023, the Biden Administration released two notices of proposed rulemaking (NPRMs), Ensuring Access to Medicaid Services (“Access” NPRM”) and Managed Care Access, Finance, and Quality (“Managed Care” NPRM), to help ensure access to quality health care in Medicaid and the Children’s Health Insurance Program (CHIP). The Managed Care NPRM aims to standardize and set a quantified floor for what it means to have timely access to care as well as provide transparency around provider payment rates. Data from our 2022 Medicaid budget survey provide a high-level snapshot of current network adequacy and availability monitoring activities and the types of penalties states may impose when standards are not met. This brief also highlights key features of state-developed standards (e.g., how states account for telehealth or public transit in network adequacy standards or define cultural competency standards for provider networks) where there may be variation across states and emerging interest in studying these issues.
This brief draws on work done under contract with Health Management Associates (HMA) consultants Kathleen Gifford, Aimee Lashbrook, Mike Nardone, and Matt Wimmer.