A provider directory can look complete on paper and still fail when someone actually calls the office. That gap is what CMS’s secret shopper requirement is built to expose. Starting in plan year 2025, medical QHP issuers on the federally facilitated exchanges (FFEs) must show that new enrollees can get appointments. They do this through independent secret shopper surveys, not self-reported directory data.
The requirement is part of CMS’s broader Appointment Wait Time (AWT) framework. For network, compliance, and provider operations teams at ACA health plans, it turns network adequacy from a filing exercise into a live, measurable operating standard.
CMS QHP Secret Shopper Requirements at a Glance
| Requirement | Current Federal Framework |
|---|---|
| Effective | Plan Year 2025 |
| AWT standards apply to | QHP issuers on FFEs, including stand-alone dental plan (SADP) issuers |
| Secret shopper surveys apply to | Medical QHP issuers on FFEs |
| Survey administrator | Independent third party, not affiliated with the issuer |
| Current secret shopper scope | Routine primary care and behavioral health |
| Compliance threshold | 90% of the time |
| Behavioral health | 10 business days |
| Routine primary care | 15 business days |
| Non-urgent specialty care | 30 business days |
| Survey period | January 1 – May 31 |
| Reporting | Results submitted to CMS after the survey window, per CMS’s AWT technical guidance |
What CMS QHP Secret Shopper Requirements Actually Measure
The question is simple: when a new patient calls an in-network provider, how long until the first available appointment?
To answer it, medical QHP issuers must contract with an independent third party. The third party contacts a sample of network providers as a prospective new patient and records the earliest appointment offered. CMS supplies each issuer with a provider population file every fall. The issuer’s vendor then surveys a statistically defined minimum number of providers for each provider type and service area. The CMS AWT Secret Shopper Survey Technical Guidance sets the sample sizes so the results carry a known confidence level.
Because the vendor must be independent, issuers cannot assess their own networks. In practice, that means working with a partner that understands both healthcare access rules and high-volume live outreach. Surveys run from January 1 through May 31. Issuers must also keep survey documentation under ACA record retention rules and be ready to provide it to CMS on request.
CMS QHP Appointment Wait-Time Standards
CMS set three appointment wait-time standards. Each must be met at least 90 percent of the time.
Behavioral Health: 10 Business Days
Behavioral health has the tightest standard and, in many networks, the hardest access problem. Provider shortages, practices at capacity, and directory inaccuracies are concentrated here. Plans should expect this category to drive the most remediation work.
Routine Primary Care: 15 Business Days
Primary care is the other surveyed category and typically accounts for a large share of sampled providers. Routine new-patient appointments, not urgent visits, are the benchmark.
Non-Urgent Specialty Care: 30 Business Days
The 30-business-day specialty standard is in effect as an AWT standard. However, specialty care is not yet part of the secret shopper survey scope, and CMS has said it expects to add specialty categories in future plan years.
Which Providers Are Included in the Secret Shopper Survey?
This distinction is often blurred, and it matters for planning.
The AWT standards cover three categories: behavioral health, routine primary care, and non-urgent specialty care. The secret shopper survey that validates those standards currently covers only routine primary care and behavioral health. The rollout was phased, with specialty validation deferred.
SADP issuers are subject to AWT standards but are not currently required to run secret shopper surveys. Medical QHP issuers are.
For operations teams, the practical takeaway is straightforward. Specialty access is not being tested by a secret shopper today, but it is still a standing obligation. Plans that start measuring specialty access now will not face a cold start when CMS expands the survey.
How CMS Secret Shopper Surveys Evaluate Appointment Access
Shoppers present as new patients seeking a first appointment at the surveyed location. The survey checks whether the provider offers in-person visits, telehealth visits, or both, and records the wait time for each.
For AWT compliance, CMS assesses the shorter of the available in-person and telehealth wait times. This detail is easy to miss and important. A provider can pass on the strength of telehealth availability even if in-person access is limited.
That scoring rule is not a reason to rely on one channel. Members who need or prefer in-person care still experience the longer wait, and complaints, grievances, and state reviews do not use the CMS scoring rule. A credible readiness program tracks both channels separately.
Why Provider Directories Can Fail the Live-Call Test
Directory inaccuracy is the most common reason an apparently adequate network fails a live appointment test. Providers retire, change practices, stop accepting new patients, or were listed in error.
The problem is well documented outside the ACA marketplace too. A 2023 Senate Finance Committee secret shopper study looked at 12 Medicare Advantage plans across six states. Of the 120 behavioral health listings contacted, only 18 percent yielded a possible appointment, and about a third had inaccurate or non-working contact information. Those findings concern Medicare Advantage, not FFE QHPs. They still show how widely directory and access problems extend across lines of business.
State enforcement and litigation are following. A 2023 New York Attorney General secret shopper review found that 82 percent of EmblemHealth’s mental health listings were not available for care. In January 2026, the American Psychiatric Association announced a class-action complaint against EmblemHealth alleging inaccurate behavioral health provider directories. EmblemHealth separately agreed to a $2.5 million settlement with the New York Attorney General over directory inaccuracies, without admitting the findings.
Tracy Gayeski, Psy.D., a health plan chief health officer, writing for Catalight, identified network adequacy as a key factor shaping access to care and noted growing attention from lawmakers. Regulators, state officials, and plaintiffs increasingly expect live confirmation of access rather than a directory listing alone.
Building a Year-Round Appointment-Access Readiness Program
A single passing survey says little about next year. The goal is a repeatable process that surfaces access gaps before the survey window opens.
Provider Directory Validation
Continuous validation of directory data (phone numbers, locations, network participation, and new-patient status) addresses the most common failure point. Ongoing checks are far easier to manage than an annual cleanup. Eligibility verification workflows can often share the same outreach infrastructure.
Live Provider Outreach
Calling provider offices with the same questions a secret shopper will ask shows how the network performs under test conditions. It also flags providers who have stopped accepting new patients.
Appointment Availability Tracking
Recording actual time to first available appointment, by provider type and service area, lets plans see where they sit against the 90 percent threshold throughout the year. That data fits naturally alongside existing quality programs reporting on HEDIS, Star Ratings, and CAHPS.
Exception Management
When a provider or region falls short, plans need a defined path: correct the listing, work with the practice on access, recruit additional providers, or help members find an available appointment. Medical appointment scheduling support can close individual member gaps while network fixes take effect.
Telehealth Validation
Confirm that listed telehealth options exist, are bookable by new patients, and are accurately reflected in the directory. Because CMS scores on the shorter wait time, telehealth accuracy directly affects results.
Behavioral health deserves priority across all five areas, given its 10-day standard and its links to parity obligations, including behavioral health prior authorization practices. Treating primary care and behavioral health as one coordinated workflow avoids duplicated outreach.
Vendor, Subcontractor, and Data-Security Considerations
Plans often use outsourced teams, onshore or offshore, to handle provider outreach and member support at volume. That makes vendor governance part of access readiness.
Any vendor handling protected health information should operate under a business associate agreement that addresses breach notification and subcontractor obligations. For the secret shopper survey itself, CMS’s technical guidance addresses vendor independence, subcontracting, confidentiality, and oversight. Issuers should review it before engaging a survey vendor or allowing that vendor to subcontract work.
If outreach is performed from outside the United States, such as the Philippines, the operating model may also need to account for local privacy law, contractual restrictions on offshore data processing, and the plan’s own data-governance policies. Before transferring sensitive data, plans should evaluate a vendor’s security controls, confidentiality procedures, subcontractor oversight, and relevant third-party security documentation. Ameridial’s healthcare call center outsourcing guide covers these evaluation criteria in more detail.
Preparing for the Next QHP Appointment-Access Survey
The survey window opens every January. Health plans that treat appointment access as a year-round operational discipline can identify network gaps before the annual survey exposes them, and can give members a more reliable path to care in the meantime.
Ameridial supports healthcare payers with HIPAA-trained teams for provider outreach, appointment scheduling, and access-related member support. If you’re evaluating your appointment-access workflow ahead of the next CMS survey window, talk with Ameridial’s healthcare payer team about managing that work at scale.
