🎧 Part I Podcast free on Apple Podcasts and Spotify.
🎧 Part II Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Table of Contents
1. The Friday drop
2. Why 2028 means 2027
3. Business one: the ninety day verification machine
4. Business two: the letter grade arms race
5. Business three: the reliance ledger
6. Business four: one attestation, every plan
7. Business five: behavioral health that answers the phone
8. Business six: the ownership graph
9. Business seven: fair market value for a PBM
10. Business eight: the July 1 report factory
11. Business nine: the transparent Part D PBM and the rebate desk
12. Business ten: pharmacy network truth
13. The zero dollar copay footnote
14. What to comment on before December 15
15. Closing
Abstract
CMS filed CMS-4214-P on Oct 16, 2026, a 265 page proposed rule implementing three sections of the Consolidated Appropriations Act, 2026. Section 6220 (the REAL Health Providers Act) makes MA plans verify every directory record every 90 days, remove departed providers in 5 business days, run an annual random sample accuracy audit weighted toward behavioral health, report a letter grade that CMS publishes in machine readable form in 2029, and cap member cost sharing at in network levels when a member relied on a bad listing. Section 6224 delinks PBM pay in Part D from drug prices starting Jan 1, 2028: flat dollar bona fide service fees at fair market value (cost plus a reasonable markup), full rebate pass through, eleven categories of annual reporting due July 1, 30 day disclosure of manufacturer contracts, annual audit rights, and disgorgement that flows PBM to sponsor to CMS. Section 6219 takes the generic copay for full benefit duals under 100 percent FPL from $1.60 to $0 in 2028 for about 6 million people. Comments close Dec 15. Ten businesses follow, each built on the gap between what plans and PBMs know about themselves and what they now have to prove.
The Friday drop
On Friday Oct 16, 2026, CMS filed CMS-4214-P, a 265 page proposed rule that implements three sections of the Consolidated Appropriations Act, 2026, the funding bill signed Feb 3 that quietly carried the biggest PBM and provider directory reforms in a decade. Federal Register publication is Oct 20, comments are due 5 pm Eastern on Dec 15, and the docket is CMS-2026-2533 if you want to spend January reading 400 trade association letters that all open with the words “we applaud.” Three sections, three sizes of bomb. Section 6219 is the small one: the generic drug copay for full benefit dual eligibles at or under 100 percent of FPL goes from $1 (CPI indexed, so $1.60 in 2026) to $0 for plan years starting Jan 1, 2028, touching roughly 6 million people, no new paperwork, and the brand copay stays at its indexed $4.90 and keeps climbing. Section 6220 is the REAL Health Providers Act, which makes MA organizations verify every provider in every network based plan’s directory at least every 90 days (acute hospitals, ICUs and surgery centers get a 12 month cadence because they tend not to move), remove departed providers within 5 business days, flag anything they could not verify with a note that the info may not be up to date, run an annual random sample accuracy analysis, report a letter grade to CMS, and starting with CY2029 watch CMS post that grade in a machine readable file while the plan displays it prominently in its own directory. Also, if a member relies on a listing that says in network and the provider turns out not to be, the member pays no more than in network cost sharing. Section 6224 is the Modernizing and Ensuring PBM Accountability piece. From Jan 1, 2028 a PBM or any of its affiliates can only get paid for Part D work through bona fide service fees: flat dollar, fair market value, for an itemized service actually performed, not based on WAC, AWP, rebates, formulary placement or volume of business. Manufacturer rebates are fine only if 100 percent of them land with the plan sponsor. Add annual reports to sponsors and CMS due July 1 (first one July 1, 2028 covering plan year 2027), a written explanation of every manufacturer contract delivered to the sponsor within 30 days of signing and certified by the CEO, CFO or GC, an annual audit right where the sponsor picks the auditor, and a disgorgement pipe that runs PBM to sponsor to CMS. CMS wrote, in its own impact table, that it cannot estimate the financial effect of the PBM piece because nobody outside the PBMs knows what the contracts say. That sentence is the whole reason the law exists.
Why 2028 means 2027
Everything above says 2028, which sounds far away and is not. CY2028 Part D bids are due the first Monday in June 2027. A sponsor cannot bid a benefit without knowing what it pays its PBM, and the PBM contract has to be rebuilt from the studs because every spread, every admin fee priced as a percent of WAC, every rebate retention clause and every GER guarantee with a mystery exclusion list is dead as of the 2028 plan year. So the actual deadline on the PBM side is spring 2027, and the RFPs and renegotiations are being drafted this winter by people who are not sleeping well. Same logic on the directory side. The first 90 day verification cycle has to complete inside Q1 2028, which means the outreach infrastructure, the provider contract amendments (the rule proposes a mandatory contract term obligating every network provider to keep its own directory info current) and the sampling methodology all need to be live by Q4 2027. CMS also noted that marketing and communications rules for CY2028 apply from Oct 1, 2027, when the annual enrollment materials go out, and the statute already set June 1, 2027 as the date CMS has to publish the standard formats for the PBM reports. For a builder that collapses a vague “2028 regulation” into a 2027 sales year with a hard calendar, which is about the kindest thing a federal agency can do for you. CMS also says a separate Parts C and D policy rule lands later this fall, so there is a second gust coming.
Business one: the ninety day verification machine
Do the arithmetic. One verification event per provider per specified MA plan every 90 days. A mid sized MAO with 60 plans across a few states carries hundreds of thousands of provider, address and phone combinations in its directories, and CMS proposes exactly that triple as the unit of a record, so a doc at two addresses is two records and a doc with two phone numbers at one address is two records. Every one of them needs a verification event four times a year, plus a 5 business day removal clock, plus the unverified flag, plus the 30 day general update rule. The rule’s menu of acceptable verification methods is basically the product spec: internal plan information (current rosters, recent claims), telephone, email, provider attestation, CMS maintained data sources (NPPES now, the NPD when it matures), claims data, and other methods CMS specifies later, a catch all CMS says it wrote on purpose because AI driven verification is moving fast. CMS also intends to rescind the two HPMS memos from Jan 3, 2020 and June 29, 2022 that let a plan off the hook if its wrong data happened to match NPPES. The NPPES safe harbor was the entire compliance strategy for a lot of plans, and CMS is pulling it with one paragraph.
So the business is an outbound verification engine: AI voice agents that call offices and get past the phone tree, email that lands with a one tap attestation, a provider facing portal, and all of it producing a timestamped, method tagged evidence record per element per cycle that a plan can hand a CMS reviewer. The economics work because the rule rewards reuse. CMS says it will let plans consolidate samples across the organization so a provider in 12 of the org’s plans gets one email, not 12. Scale that across clients and the same front desk that is being hammered by 40 plans gets verified once a quarter by one vendor, and the attestation is syndicated to all 40. That is the CAQH model applied to directory elements, and CAQH’s data famously does not cover accepting new patients or telehealth, which is exactly why CMS wrote that NPPES alone will not cut it. Pricing is per record per cycle with a premium for the elements front desks hate answering (panel status, disability accommodations, telehealth). Kyruus, Veda, H1, LexisNexis, Quest Analytics and CAQH itself will all claim this; fwiw the gap is outbound capacity at scale and the evidence ledger rather than another dashboard. Between June 2022 and June 2024 CMS ran its own reviews of 142 MAOs, 11,360 providers and 18,852 locations by having humans call offices, and found 44.29 percent of location listings had at least one deficiency, with PCPs at 45.73 percent, cardiologists at 47.66, oncologists at 45.67 and ophthalmologists at 38.34. Plans already know what a CMS caller finds. That number is their 2028 grade preview.
Business two: the letter grade arms race
The scoring formula is public and weighted: network participation status 40 percent, contact info 20, address 20, specialty 10, accepting new patients 3, disability accommodations 3.5, telehealth 3.5. Scoring is binary per element (every part of the address has to match, though “st” versus “street” is forgiven), summed across the sample, weighted, rolled into a composite and translated into a letter grade. Provider name, cultural and linguistic capabilities and the new ownership disclosure sit in the directory but not in the score. CMS is still deciding on partial credit (0.5 if at least half the parts of an element are right), confidence scoring (1.0 only if two methods agree), sample size floors and ceilings, a minimum response rate, replacement of non responders, and whether sample dates are fixed, plan chosen, or randomly assigned inside a quarter to stop plans from scrubbing the week before. The sample itself is 65 percent general and 35 percent high inaccuracy specialties, and today the only high inaccuracy specialty is mental health and SUD, defined by Medicare specialty codes 26, 27, 86, 62, 68, 80, 79, D5, E1 and E2 plus a few NUCC taxonomies. CMS also restricts which methods count for which elements in the score: internal plan info and claims only prove participation and specialty, phone and email cover the six contact style elements, attestation covers everything. Attestation is the universal key, so whoever owns provider attestations owns the grade.
The business is a score engine. Ingest the plan’s directory, build the sampling frame exactly the way CMS defines a unique record, draw a compliant sample, run the verification, compute the composite under every variant CMS is still chewing on, and tell the plan its grade nine months before the audit along with the cheapest path to an A (fix participation status first, it is 40 percent of the grade and it is the one element claims data can verify for free). Layer on an independent pre audit, because once grades are public in 2029 and brokers are using them to steer enrollment, a B minus becomes a sales problem and the compliance team will pay for a second opinion. Star Ratings consulting is a nine figure industry built on a public scorecard with a published formula; this is a brand new one with a hard launch date. The gaming is obvious (cull the sketchy records before the draw, oversample easy specialties, pray for a friendly sample date) and CMS says as much in the rule, which is why it floated randomly assigned dates. A vendor that keeps a plan clean year round has a better story than one that shows up in August with a mop.
Business three: the reliance ledger
New 422.124 says an enrollee who relies on a directory listing that says in network and gets care from a provider who turns out to be out of network pays no more than in network cost sharing. Operationally that means a plan has to answer, with evidence, what its directory said on the day the member looked, and no plan can do that today. Directories are live databases that overwrite themselves; the PDF copy refreshes within 30 days, or 5 business days for removals, and then the old version is gone. So the product is a directory snapshot ledger: immutable, timestamped, queryable captures of every published directory state, paired with an intake and adjudication workflow for cost sharing protection requests that pulls the snapshot, matches the claim, reprices to in network, and tracks the delta as a reportable cost. CMS lists processing these requests as a new administrative cost in its impact table, which means plans will budget for it, which means there is a line item to sell into.
The consumer side is more fun. A member who got a surprise out of network bill from a provider the directory called in network now has a statutory remedy, and most of the 35 million or so people in MA will never hear about it. The No Surprises Act spawned bill negotiation startups; this spawns the MA version, smaller dollars per case but a cleaner legal hook, and the evidence lives in the plan’s own directory history. SHIP counselors, brokers and plaintiffs’ lawyers will want the snapshots too, which is one more reason a plan buys the ledger before somebody builds it against them.
Business four: one attestation, every plan
Flip to the provider side. The rule proposes that every MA network contract carry a term obligating the provider to maintain current and accurate directory information. Providers already ignore roster requests; from 2028 ignoring them is a contract breach, and every plan is required to pester them four times a year. A multispecialty group with 300 clinicians, 40 locations and 15 MA contracts is staring at 60 verification cycles a year, each touching hundreds of records, with outreach landing on front desk staff who have no idea what telehealth capability means for Dr. Patel on Tuesdays. The provider side product is a single source of truth for the practice (clinician, location, phone, specialty, panel status, accommodations, telehealth and now ownership) that publishes to every plan in the plan’s required format, auto answers inbound verification requests, and keeps the attestation trail the group needs when a plan tries to blame it for a bad grade. The EHR and practice management vendors are the natural owners and mostly have not bothered; the credentialing crowd (symplr, Medallion, Verifiable and friends) is adjacent. The wedge is panel status: accepting new patients is the one element only the practice knows, it changes weekly, and CMS gave it a 3 percent weight precisely because it is miserable to maintain. Get the practice to maintain it once and you can sell it to every plan in the market.
There is a bigger version of this. CMS wrote repeatedly that the directory data it already collects from plans for Medicare Plan Finder is meant to feed the National Provider Directory, and that the NPD may become an approved verification source once it matures. A prior essay in this newsletter went through the NPD’s April 2026 release in detail (27 million records, 71 percent of practitioners orphaned from any organization, zero percent with hours of operation), and the obvious fix for those gaps is a provider side publishing layer that writes to plans today and to NPD FHIR endpoints tomorrow. The rule just handed that layer a paying customer on both ends.
Business five: behavioral health that answers the phone
CMS made behavioral health 35 percent of the accuracy sample because the data is grim. OIG’s October 2025 report found that on average 55 percent of BH providers listed in MA and Medicaid managed care networks did not bill a single service in 2023, and when OIG surveyed a sample of those inactive providers, 72 percent said they should not have been listed at all. Ghost networks are the network. Under the new regime a plan has two choices: keep the ghosts and tank 35 percent of the grade while eating cost sharing protection claims from members who find out the hard way, or cull the ghosts and blow up network adequacy. Both are expensive. The business that resolves it is real BH supply contracted to MA at scale with verifiable availability. The Headway, Alma, Rula and Grow style aggregators did this in commercial because commercial pays; Medicare pays LCSWs, MFTs and mental health counselors 75 percent of the fee schedule, and MFTs and MHCs only became billable in 2024, so almost none of that supply has been pointed at MA. An MA focused BH network builder that delivers a roster of clinicians who actually accept the plan, actually have openings, and answer a verification email inside the 7 business day non response window CMS floated is selling a grade and an adequacy filing in the same contract. Pricing is per member per month for network access plus the verification feed. D-SNPs buy first, since their members overlap Medicaid managed care, where OIG looked too.
Business six: the ownership graph
CMS added a ninth directory element Congress did not list: common ownership or control disclosure. If a provider, group, facility or supplier is owned or controlled, in whole or in part, directly or indirectly, by the MAO, its parent, a sibling subsidiary or anything under common control with it, the directory has to say so, with model language along the lines of “This provider is under common ownership or control with” the parent. CMS was explicit that it wants researchers, SHIP counselors, brokers and policymakers to be able to measure vertical integration straight from the directory. The element is not scored yet, but it has to be populated by CY2028 and it has to be right, because the first headline about a national carrier listing a few thousand of its own clinics as unaffiliated writes itself. The business is an entity resolution and ownership graph: map every TIN, NPI, DBA and intermediate LLC to its ultimate parent, keep it current through M&A, and sell it three ways. Plans buy the compliance feed. Everyone else buys the vertical integration dataset (plan networks by percent affiliated, referral leakage, affiliate versus non affiliate reimbursement differentials). PBMs and Part D sponsors buy the mirror image, because section 6224 reaches any entity that owns, is owned by, controls or is controlled by a PBM or sponsor, plus any contractor or agent performing PBM functions, and CMS’s June RFI asked point blank whether rebate aggregators, data vendors, wholesalers, pharmacies and benefit consultants should count as affiliates. One ownership graph, two regulatory customers.
Business seven: fair market value for a PBM
Delinking turns PBM revenue in Part D into a cost plus business. The proposed rule defines fair market value for a bona fide service fee as the cost of the itemized service plus a reasonable markup, which is the single most consequential phrase in the document and will be litigated by people billing $900 an hour, which is itself a markup. Every service a PBM performs for a sponsor (claims adjudication, formulary management, rebate contracting, utilization management, network management, mail and specialty operations, reporting) now needs an itemized cost, a defensible markup, and an FMV opinion the sponsor can rely on and OIG can review, since the statute hands the Secretary and OIG the job of reviewing PBM remuneration and disgorging whatever fails. CMS’s June RFI asked how anyone determines FMV for PBM services today, whether it varies by entity type, and whether it should account for market concentration (three PBMs handle roughly 80 percent of claims) and vertical integration. The honest answer was that nobody does, because fees were never where the money was.
This creates an industry that exists for physician compensation, 340B and Stark but not for pharmacy benefits: PBM services FMV benchmarking. A firm with a defensible cost model per service, a benchmark database across PBMs and sponsors, and a markup methodology will be in every 2028 contract. Sponsors need the opinion for the annual compliance certification the statute requires them to sign. PBMs need it to keep their fees. Auditors need it to audit. The moat compounds because the July 1 reports make every PBM disclose, per plan, the total it retained including bona fide service fees, so by mid 2028 there is a semi public benchmark that a firm which started in 2027 will already have modeled. Think Milliman or ECG for PBM fees, built from scratch, with software instead of a 200 page PDF.
Business eight: the July 1 report factory
The statutory reporting package is enormous. Per plan, per year: an NDC level dispensing report with enrollee counts, pharmacy type, WAC, AWP, out of pocket spend, manufacturer rebates, DIR, average pharmacy reimbursement by channel, average NADAC, and manufacturer revenue retained by the PBM or any affiliate; an affiliate report with the share of scripts dispensed by affiliate pharmacies, combined plan and enrollee cost ranges for 30 and 90 day supplies at affiliate versus non affiliate pharmacies, affiliate acquisition cost against NADAC, and 340B drugs dispensed under PBM affiliate covered entity contracts; a brand versus generic formulary report listing every brand covered where a generic exists, with written justification and the count of equivalent generics; the same for biologics versus biosimilars; gross spend, retained amounts and net spend; benefit designs that steer members to affiliate mail, specialty or auto refill; broker and consultant compensation with the calculation methodology; the full affiliate list; and a summary document in a standard format CMS has to publish by June 1, 2027. Price guarantees now have to ship with definitions of generic, brand, specialty, rebate and discount, a list of exclusions, and a WAC equivalent for any other benchmark. Manufacturer agreements get a written explanation to the sponsor within 30 days of signing, incentive contingencies and formulary placement included, certified by the CEO, CFO or general counsel.
When the CAA 2021 created RxDC reporting for commercial plans, a dozen vendors built compliance reporting businesses in 18 months. Same movie, bigger budget. Three products fall out. A PBM side reporting engine (the big three build internally, the next 40 PBMs buy). A sponsor side intake and benchmarking layer that normalizes reports across PBMs and tells a regional MA-PD that its affiliate mail pricing runs 30 percent above NADAC against its peer group. And the audit stack, because the statute gives sponsors an annual audit right where the PBM must produce records within 6 months and answer follow ups within 30 days, with an auditor the PBM does not get to pick and affiliate data included. PBM audit firms exist for commercial; the Part D version has statutory teeth, a confidential reporting channel with anti retaliation protections, and a disgorgement destination. The customers who need all of this most are the long tail of Part D sponsors, regional Blues and provider sponsored plans that have never seen their own claims at NDC level with NADAC sitting next to them, and are about to.
Business nine: the transparent Part D PBM and the rebate desk
If PBM income in Part D is capped at cost plus markup on itemized services and 100 percent of rebates pass through, the incumbent model (keep a slice of rebates, run spread, price admin fees off WAC, route specialty to your own pharmacy, have your GPO affiliate collect a manufacturer fee) loses most of its margin stack inside Medicare. The transparent PBMs (Judi Health, the artist formerly known as Capital Rx, plus Navitus, SmithRx, Rightway, AffirmedRx and the rest) were built to charge flat PMPM admin fees and pass everything through; the statute just made their pricing the only legal pricing in a program with north of a quarter trillion dollars in gross drug cost. The open question, tbh, is whether they can actually run Part D, which is operationally brutal (LIS tiers, the redesigned benefit phases, DIR reporting, Star measures, program audits). So the business is either a Part D native pass through PBM or, more realistically for a startup, a Part D adjudication and rebate infrastructure layer that sponsors license to insource the parts they want. Several large sponsors will try contracting rebates directly with manufacturers now that the PBM has to hand over its manufacturer contract terms within 30 days anyway, and the rebate aggregator GPOs (Zinc, Ascent, Emisar) sit squarely in the affiliate crosshairs CMS asked about in June. A sponsor side rebate desk, staffed by people who used to work at those GPOs, with contract management and reconciliation software, is a real company. The constraint is manufacturer appetite to contract with 200 sponsors instead of three PBMs, which is why the desk probably launches as a service for the top 20 sponsors and productizes downward.
Business ten: pharmacy network truth
The affiliate pharmacy reports plus section 6223 (not in this rule, but same law, same clock) create a pharmacy side data product. Starting plan year 2028 CMS will publish lists of essential retail pharmacies (non affiliated, with no other retail pharmacy within 10 miles rural, 2 miles suburban or 1 mile urban, tighter than the 15, 5 and 2 mile access standards), sponsors must report affiliate pharmacy lists and pharmacy incentive payments (incentive payment reporting starts PY2027), and CMS will publish trend reports comparing essential versus non essential pharmacies on ingredient cost, fees, amounts paid, network participation, cost sharing and volume. The “reasonable and relevant” contract term standards get an RFI by April 1, 2027, standards by the first Monday of April 2028, effective PY2029, with a formal pharmacy complaint process by Jan 1, 2029 and civil money penalties available against sponsors, who in turn must have written agreements making the PBM pay them back. Independent pharmacies and PSAOs have never had this much statutory muscle, and historically they have had roughly none. The business is the pharmacy side analytics and complaint engine: benchmark every contract term and every reimbursement against NADAC and the public trend reports, determine essential retail pharmacy status by geocoding the competition, build the one allowed complaint per contract per plan year with evidence attached, and sell it through PSAOs and state associations by the pharmacy. The mirror product sells to sponsors, who now have to defend their networks and explain in a report CMS reads why affiliate mail pricing looks the way it does. The GAO study due Feb 2, 2028 is already scoped to examine price linked compensation for wholesalers, pharmacies, PSAOs and brokers, so the next round of delinking targets is named in the statute. Build for the pharmacies now and you will have the data when the wholesalers get their turn.
The zero dollar copay footnote
Section 6219 is small money and smaller paperwork, but there is a sliver of business in it. About 6 million full benefit duals at or under 100 percent FPL stop paying $1.60 and rising per generic fill in 2028, while brand copays stay at $4.90 and keep indexing. That widens the brand versus generic gap for the population with the worst adherence and the highest Star exposure for D-SNPs, and it also relieves pharmacies of the joy of collecting $1.60 on a debit card with a 30 cent interchange fee. The angle is a dual focused generic substitution and adherence program pitched to D-SNPs as a Star play: with the copay at zero the last financial excuse for a missed generic fill disappears, and the PDE data will show whether the plan did anything with that. CMS also made clear it is proposing nothing beyond the conforming change here, so anyone hoping for a broader LIS cost sharing rewrite is waiting on the Parts C and D policy rule later this fall.
What to comment on before December 15
The open questions in the rule are a map of where the business rules will land, and the comment deadline is Dec 15. On directories: minimum and maximum sample sizes (CMS proposed neither), partial credit versus binary scoring, confidence scoring across methods, fixed versus random sample dates, whether PCPs, cardiologists and oncologists join behavioral health as high inaccuracy specialties (their 45 percent plus deficiency rates already clear the threshold CMS floated), whether the NPD becomes a score eligible source, and whether CMS collects response rates by method and specialty. A verification vendor wants attestation ecosystems and the NPD recognized and wants a minimum response rate, because minimums create demand. On PBMs: the affiliate definition (are GPOs, data vendors, consultants and wholesalers in), what reasonable markup means in actual numbers, what counts as an itemized service, which incentive fees survive, and what the standard report formats look like. A sponsor wants everything in; a transparent PBM wants a tight itemized service list so incumbents cannot relabel spread as network management. Builders rarely comment on rules and should, because the letters that name specific verification methods and data elements are the ones CMS cites when it writes the technical guidance, and the guidance is where the product requirements actually live.
Closing
The pattern across all three sections is the one that has powered health tech for twenty years: Congress makes a number public. In 2012 it was Medicare claims, in 2016 hospital star ratings, in 2021 hospital price files. This time the number is a letter grade on Plan Finder, a fee on an itemized invoice, and a NADAC comparison in a report CMS can read, and every time that happens a business gets built on the gap between what the regulated entity knows about itself and what it now has to prove. This one comes with a calendar: contracts rewritten by spring 2027, verification live by Q4 2027, first grades and first PBM reports in 2028, grades public in 2029. The rule runs 265 pages and a good chunk of them are CMS asking for help. Take the hint
.