819,398 Providers. Nobody Watching the Gaps.

819,398 Providers. Nobody Watching the Gaps.

Picture a credentialing coordinator on a Wednesday morning, opening a stack of denied claims. She finds one she did not expect: a clean provider, recently credentialed, no expired licenses, nothing on the OIG exclusion list. The denial reason is a directory mismatch. The payer's record shows an address that changed seven months ago. The practice filed the update. Somewhere between that filing and the payer's database, the update got lost, or stalled, or simply never propagated. The claim was always going to fail. Nobody would have known until this Wednesday.

That is not an edge case. That is the baseline.

The gap nobody budgets for

We monitor 819,398 providers across 219,144 practices, and from what I keep seeing in the data, the single most common credentialing threat is not an expired license. An expired license is visible. It announces itself. The threat is quieter: it is the data that was accurate the day someone last checked it, and then quietly stopped being accurate, with no one watching in between.

Provider records drift. Addresses change. Group affiliations get added and dropped. A state medical board posts a summary suspension on a Thursday afternoon. A DEA registration gets flagged. NPPES reflects a telehealth address that was never meant to be a billing location. None of these events fire an alert inside a credentialing system that runs on a 180-day or even a 120-day cycle. They just accumulate, silently, until they surface as a denial, an audit notice, or a payer-directory error that a patient encounters first.

Atlas Systems published research in early 2026 showing that 20% of provider directory listings contain inaccuracies, and that 50% of "accepting new patients" statuses are wrong. (Atlas Systems, "Data Challenges in Healthcare: Improving Data Accuracy," February 2026.) That is not a technology failure. That is a cadence failure. Data is being checked at moments, not monitored across time.

What actually happens between audits

NCQA moved the goalposts in 2025, and I think the move is telling. Credentialing files now require monthly review for every provider, effective July 1, 2025, covering license status, OIG exclusions, state board actions, and SAM.gov screening. The credentialing window itself compressed from 180 to 120 days for accredited organizations and from 120 to 90 days for certified ones. (MedCare MSO, "Medical Credentialing in 2026: What Has Changed and How to Navigate It," April 2026.) The regulatory direction is unambiguous: point-in-time verification is not enough anymore.

CMS formalized the same logic at the federal level. Final Rule CMS-4208-F2, effective January 1, 2026, requires Medicare Advantage plans to update provider directory data within 30 days of learning of any change and to attest annually to accuracy. (Credentialing DDS, "Your Provider Directory Is Probably Wrong in 2026," June 2026.) The downstream pressure reaches all the way to the practice: MA plans are now actively reaching out to verify and re-verify provider information. If the practice's own records are stale, they will fail that verification.

And the stakes on the other side of a failure keep rising. CMS's 2024 enforcement actions levied civil monetary penalties on 14 MA sponsors, with 16 of 18 violations carrying aggravating factors. The 2025 per-determination minimum CMP stands at $26,544. (WilmerHale, July 2025, citing CMS Audit and Enforcement Report.) That is the cost for a plan. The cost for a practice that contributed inaccurate data ripples differently: denied claims, delayed enrollment, billing suspension.

One address change, traced forward

Here is something close to a pattern I have watched play out more than once in our data. A provider at a Texas multi-specialty clinic moves to a new suite in the same building. The address change is minor, a suite number. The practice updates CAQH. NPPES takes a few weeks to reflect it. One payer pulls directory data from a third-party aggregator that re-syncs quarterly. A second payer has an open provider relations ticket that takes six weeks to process. A third payer's directory never gets the update because that payer only accepts attestation updates during a specific enrollment window.

Six weeks later, a claim comes back denied. The reason code references a directory mismatch. The billing team assumes it is a coding error and works it. The underlying mismatch is still live. Three more claims fail before anyone traces the thread back to the suite number.

The total denial exposure from that one data point, across three payers over six weeks, runs to more than a dozen claims. MGMA data puts the average cost to rework and appeal a single denied claim at $118.00. (Human Medical Billing, citing MGMA, November 2025.) Twelve claims is $1,416 in rework costs, before counting the revenue risk on each claim itself. And that is one provider, one address field, one building.

Multiply that by 819,398.

The scale of what is unmonitored

What makes this hard is that the data lives in separate systems that were never designed to talk to each other in real time. NPPES is updated by providers on an honor system with no enforcement of a specific refresh cadence. Payer directories pull from rosters and attestations on cycles that vary by payer. State license databases post changes when they post them. No single system knows what the others know, or when.

A Black Book Research survey of 1,710 health systems and physician executives found that 71% of healthcare organizations have encountered significant challenges navigating the evolving regulatory landscape for provider data, and 16% said their current systems had essentially failed to ensure compliance. (Black Book Research, via Newswire.com, August 2024.) That failure rate is not surprising when you understand the architecture: organizations are trying to manage a continuous-data problem with point-in-time tools.

Argoseer's monitors do not replace that architecture. We are not a CVO, we do not perform NCQA primary source verification, and we do not issue or guarantee licenses. What we do is watch the records between the cycles: NPPES delta ingestion, state license database polling, payer-directory comparison against what the credentialing system believes to be true. When we see a mismatch, we surface it, with enough context to route it to the right person before it becomes a denial.

From what I keep seeing in the data: 12,026 practices in our current monitoring set have at least one active mismatch between their credentialing system's records and what we see in primary sources. That is not 12,026 catastrophic failures. Most of them are small, the kind of small that stays invisible until the wrong claim hits the wrong payer on the wrong day.

The question that does not go away

NCQA's move to monthly review is the right direction. CMS-4208-F2 is the right direction. The financial penalties for stale data are headed in one direction too.

But regulation does not watch the data. It sets expectations for when you should have watched it, and what the consequences are for not having done so. The actual watching still has to happen, and for most organizations running credentialing on a 90 to 120-day cycle, it is not happening at the cadence the data requires.

So the real question is not how to fix one denied claim. It is who is watching the data on a random Thursday afternoon in March, when a state board posts an action and the next credentialing cycle is still 60 days away.

If you want to see how Argoseer monitors between your cycles, the product page is a reasonable starting point. But the more important thing is to ask the question for your own roster: what changed this week, and how long until your current process would have found it?