No Surprises Act provider directory 90-day attestation workflow

Steps

1. Establish a provider data management system that tracks every contracted provider's last verification date; the NSA requires health plans to verify all directory entries at least every 90 days.
2. Build an outreach workflow: send automated requests (email, portal, or API call to credentialing system) to each provider asking them to confirm or update name, specialty, address, phone, and network participation status.
3. Set a response deadline of fewer than 90 days from the last verification to allow time for follow-up; remove providers who do not respond within the plan-defined window from the public directory.
4. Process confirmed updates within two business days of receipt as required by the NSA; update both the online and print directory data sources simultaneously.
5. Log every verification transaction with provider NPI, verification date, method, and outcome; this audit trail is required for regulatory examinations and CMS enforcement.
6. Trigger an out-of-cycle verification whenever a provider submits a data change or when a credentialing event (recredentialing, termination, privilege change) occurs.