Provider data accuracy: Regulatory compliance and hidden network risks

Welcome to part one of our new blog series on provider location data—an exploration into the messy, high-stakes world of healthcare compliance, address accuracy, and network adequacy.

To kick things off, we sat down with Dave Medlock, founder of Maven One Health and a contributing thought leader, to discuss why clean provider data is essential for achieving peak regulatory compliance and meeting requirements with ease, thereby avoiding serious consequences if it isn’t done correctly.

Here’s what he had to say about understanding CMS, state DOIs, continuous audits, rosters, data decay, messy inputs, and the future of address data itself.

The regulatory maze: CMS, state DOIs, and never-ending audits

If you manage provider networks (looking at you payers), you already know compliance doesn’t stop after patient sign-up. 

Between the Centers for Medicare & Medicaid Services (CMS) and state Departments of Insurance (DOIs), health plans are required to maintain up-to-date provider directories and prove their networks meet adequacy requirements.

That means having enough providers—by specialty and distance, or by drive time—for every covered member. For example, a plan may be required to demonstrate that every member has access to a primary care physician within a 10-mile radius or within 20 minutes. The requirements vary depending on the area type (e.g., metro, micro, rural). 

Simple, right? Until you realize that half of your addresses in your master database don’t actually exist, or that they’re CMRAs or PO Boxes where medical offices couldn’t actually be located.

Dave puts it bluntly:

“A health plan might claim four endocrinologists within 25 miles, but two of them could be listed at a grocery store pharmacy. On paper and to a patient who might not know any better until they try to navigate there, you look compliant. In reality and to the well-trained eyes who know better, you’re not.”

This kind of mismatch between provider “reported data” and “real data” leads to what Dave calls “unintentionally keeping two sets of books”—one for compliance reporting and one that actually reflects where care happens. It’s not that healthcare platforms are nefariously doing this (trying to get away with non-compliance by keeping a secret set of books), but good intentions don’t mean you’re compliant.

They have one job, and they intend to do it well. 

You can see the pervasive problem our society faces in maintaining mismatched data, as evidenced by CMS’s own provider directory audit findings, which revealed that almost half of provider directory entries across Medicare Advantage plans contained at least one error. Yikes. 

It’s a known issue, but the problem doesn’t just lie in the fact that we aren’t being regulatorily compliant. These rules are in place for a reason, and when healthcare platforms and providers struggle to keep up with the constant changes (such as providers changing employment or relocating), other aspects of the system begin to break down as well.

The provider data problem: Rosters, decay, and mess

The problem starts with the rosters—those infamous spreadsheets sent by provider groups, hospitals, and urgent care facilities. They come in every format imaginable, often with missing fields, combined address lines, duplicates, or inconsistent naming conventions.

Even when rosters are formatted correctly, they’re rarely updated as quickly as they need to be. 

It’s not for lack of effort—providers juggle an overwhelming amount of back-office work, and payers often rely on systems that don’t easily capture every change or variation. Both sides do their best to keep up, but roster updates inevitably take a backseat to higher-stakes tasks like billing and claims processing. 

If you don’t bill, you don’t get paid; if you don’t update a roster this month, the consequences feel less immediate. The result is predictable: providers move, practices close, clinicians retire—and the roster simply doesn’t keep up. 

Even more dangerously, some providers lose their licenses and are placed on watch lists for criminal offenses, yet remain in outdated databases longer than they should, putting a society relying on that data at risk.

“What you file on January 1 might be 50–70% outdated by the next year,” Dave said, referring to the many things that can happen, even and especially at the address level. Street names change, ZIP Codes shift, and more.

That “data decay” not only hurts patient access—it’s a compliance nightmare. Dave explained that the CMS or a state DOI can demand a network adequacy report at any time, and providing inaccurate data can result in hefty fines and mandatory corrective action plans.

In 2024, for instance, MVP Health Care was fined $250,000 by the New York Attorney General for publishing directories that included non-existent or unreachable mental health providers. 

The problem wasn’t intention-based—it was simply the fact that they maintained inaccurate and outdated address data.

Why address validation matters (and where Smarty fits in)

Address validation tools, like Smarty’s US Address Validation, US Address Autocomplete, and US Rooftop Geocoding APIs, help ensure each provider's address is real, complete, and standardized before it ever enters a compliance report.

As Dave explains, “You can’t be accurate if you’re not complete and valid. Smarty helps us confirm the validity of every address before we assess accuracy.”

Once validated and geocoded, those addresses become the foundation for mapping drive-time distances, pinpointing network gaps, and ensuring regulatory compliance with confidence.

Additionally, almost every product is built with SmartyKey® running the show. It’s our persistent, unique identifier (PUID) that helps you track address changes over time, linking the older, no-longer-accepted version of the address with the newer, valid version. 

An EXT is available for every address alias. This enables you to discover the historical addresses of a location. Additionally, with a little additional coding, you can enable the EXT to update you if the aliases change or a new primary address is created.

But there’s more to it than just getting a valid or not valid response from Smarty and knowing the location history. 

We asked Dave if he would be willing to spill his secrets on how he makes the data work for him. 

We were met with an enthusiastic “Yes!”

Metadata: the secret sauce for smarter compliance

Beyond just validating an address, Dave’s team relies heavily on Smarty’s metadata and DPV (Delivery Point Validation) footnotes. These data points reveal why an address failed and give further scope to an entered address.

The metadata returned with Smarty’s US Address Verification and US Rooftop Geocoding products enables you to implement and automate some pretty amazing analysis that keeps you compliant. Some of the more common Smarty metadata points are listed below (there are up to 55 total per address!). 

We’ll discuss their healthcare use cases for regulatory compliance to hopefully help you up your game.

Those small but critical details help Maven One Health’s rules engine flag and resolve issues automatically for their customers—before they become audit problems.

“Knowing what’s wrong with an address gives you the power to fix it,” Dave said.

Dave is currently using parsed address data and DPV footnotes to flag potential address mistakes, and he’s excited to have recently learned about new address component analysis capabilities that Smarty now offers. 

Smarty breaks address results down component by component, analyzing each part (primary number, predirectional, street name, street suffix, etc.) to determine:

• What was updated (e.g., primary number, street name, etc.)
• The reasons for the change (e.g., "added", "abbreviation", "spelling", etc.)
• Whether each component is real (confirmed) or not real (unconfirmed)

This can help you know when to prompt a provider to add a secondary indicator (suite number, etc.), which vendors consistently deliver addresses needing correction (and how often), and flag other address-related issues before the bad data enters your system.

The future of provider data compliance

So, is there hope for cleaner data in healthcare? Dave thinks so—but it’ll take collaboration.

“The real fix comes when providers and payers exchange data the same way we handle claims today—with standard formats, validation at the point of entry, and ongoing automation. The only way we can scale these solutions economically is through this kind of automation.” 

Dave continued, “There are over 9 million NPIs (National Provider Identifiers), and each of those can potentially be associated with many locations. We see roughly two addresses per provider that we track. Validating that data by hand isn’t practical or possible.”

Until a more accurate and quicker way to verify and update provider data across platforms emerges, health plans that invest in address validation, geocoding, and data standardization will be those already ahead of the curve.

Coming up next in the series

This post is the first in a multi-part series on provider location data in healthcare. Upcoming topics will include:
 • Improving member experiences and provider directories 
 • Building more accurate claims and streamlining operations

If you’re tired of “data decay” being your compliance stumbling block, stay tuned—because the next post digs into the nuts and bolts of keeping provider directories alive and accurate.