CMS CRUSH Compliance: What Health Plans Need Beyond Accurate Provider Directories

CMS CRUSH — the Consolidated Reporting for Uniformed Standardization of Healthcare — represents the latest push toward standardized, auditable provider network data reporting for health plans.

The operational challenge for health plans is not the reporting itself. Most plans already collect the underlying data. The challenge is demonstrating that the data is trustworthy enough to submit — that the processes that produced it are defensible, auditable, and compliant with the standards CMS is moving toward.

That is a data trust problem, not a reporting problem.

What CRUSH actually requires

At its core, CRUSH compliance asks health plans to report standardized information about their provider networks: accurate specialties, current network participation status, up-to-date location data, and verified contact information. The No Surprises Act created initial liability for directory inaccuracies. CRUSH tightens the reporting requirements and creates structured accountability for how plans manage the underlying data.

The question regulators are increasingly asking is not just: is this directory accurate today? It is: what is your process for ensuring it stays accurate, and can you demonstrate that process is working?

That is a provenance and recency question — two of the eight dimensions in the Data Trust Index.

The audit trail gap

Most health plans rely on credentialing workflows to produce provider data, then push that data into directories and reporting systems. The credentialing workflow documents that a license was verified. What it does not document is the full chain of custody from primary source to submitted report — which source was used, when it was accessed, how it was compared against other sources, and what happened when sources disagreed.

When a CMS auditor asks why a provider appears in the directory with a specialty that differs from what the state licensing board shows, the answer needs to be more than: our credentialing team verified it. It needs to be a documented, timestamped, source-attributed audit trail.

SuperTruth's IntegrityNet creates exactly that audit trail at ingestion. Every record received from every source is logged with full provenance metadata: source identity, access timestamp, field-level capture documentation, and any concordance flags raised when sources disagree. The DTI Engine scores each record and attaches that score permanently. When a CMS auditor asks for evidence, the audit log is there.

Why 90% accuracy is not enough

Credentialing platforms commonly target greater than 90% data accuracy. That sounds strong. For a health plan with 50,000 providers in network, it means 5,000 records with accuracy issues at any given time.

Accuracy is a point-in-time measurement. Provider data decays. Physicians move. Specialties change. Hospital affiliations are updated quarterly in some systems and annually in others. A record that was 100% accurate at last verification may be partially stale by the time a member uses it to find an in-network specialist.

The DTI Recency dimension addresses this directly. Each record carries a recency score reflecting elapsed time since last verification, with decay rates calibrated to the data type. A provider's NPI number changes rarely if ever — high recency score even years after last verification. A hospital affiliation can change in a quarter — lower recency score as time passes. The score signals to any downstream system how much weight to place on this record right now, not just whether it was accurate when it was last touched.

The consent dimension CRUSH requires

CRUSH and related CMS initiatives increasingly require that provider data collected for one purpose (credentialing) not be used without authorization for other purposes (AI-driven network adequacy modeling, for example). This is the same consent governance problem GDPR introduced for consumer data, applied to provider data.

ConsentOS tracks which uses are authorized for each record. A provider who authorized their data for directory publication did not necessarily authorize its use in a network adequacy AI model. The consent state is tracked at the record level and propagated instantly when a provider updates their authorization.

For compliance teams building audit-ready documentation, that consent audit trail is exactly what regulators are beginning to ask for.

Practical implications

Health plans preparing for CRUSH compliance face three data trust challenges simultaneously:

Provenance documentation: Can you demonstrate where each data element came from and when it was verified?

Recency management: Can you show which records are current enough for directory publication versus which need reverification?

Consent governance: Can you demonstrate that your use of provider data is authorized for each downstream application?

SuperTruth addresses all three through the DTI pipeline. IntegrityNet captures provenance at ingestion. The DTI Engine scores recency continuously. ConsentOS governs use authorization.

The result is provider data that is not just accurate at a point in time but demonstrably trustworthy for specific regulatory uses — with an audit log that holds up under CMS scrutiny.

Further reading: See our approach for health plans To discuss CRUSH compliance readiness and what trust-scored provider data looks like for your network, reach Louis Simeonidis at schedule a conversation or (215) 918-4140.