CMS-4208-F2 and Medicare Plan Finder: What’s Actually Required, and What It Means for Your Plan

If you’ve been tracking CMS-4208-F2, you’ve probably seen a lot of noise in the market lately, blog posts, LinkedIn alerts or vendor readiness checklists. Some of this is helpful, however, some of these sources are getting the requirements wrong in ways that could lead your team down a more complicated and costly path than necessary. 

We want to give you a clear picture of what this rule actually requires, how it fits within the broader and expanding set of FHIR-based interoperability mandates you’re already subject to, where the real complexity lies, and how we’re working with our customers to get them ready. 

Here’s What the Rule Actually Says 

Since 2020, MA plans have been required under CMS-9115 to expose a FHIR-based Provider Directory API, meaning if you’re a health plan Kyruus Connect customer who subscribes to our Provider Directory FHIR API, you’ve already been complying with a federal provider-directory interoperability mandate for years. CMS-4208-F2 builds on that foundation; it doesn’t replace it. 

CMS-4208-F2 was finalized on September 19, 2025 and is rolling out in three phases. Phase 2 is what most plans are focused on right now, and it has a hard go-live date of October 1, 2026 — right before Annual Enrollment Period kicks off. 

• Phase 1 (CY 2026): Plans were strongly encouraged, but not required to share data for display in Medicare Plan Finder via a third-party vendor. 
• Phase 2 (CY 2027, live October 1, 2026): CMS will ingest provider directory data directly from MA plans via publicly accessible files, either machine readable JSON files or FHIR-based JSON files. Plans must complete annual attestation in HPMS by September 1, 2026. CMS testing opened May 4. 
• Phase 3 (Future): CMS is developing a National Provider Directory populated entirely on FHIR-based APIs. Full FHIR compliance will be required, but that’s a future requirement, not today’s. 

Phase 2 is where the FHIR conversation gets muddled, so it’s worth being precise. Some vendors are telling plans they need to expand their FHIR APIs specifically to meet MPF Phase 2. That’s not accurate: Phase 2 is built around static JSON file crawls, not a FHIR API exchange. To be precise about what that does and doesn’t mean: FHIR provider-directory APIs are already mandated under CMS-9115 (2020), and several states layer on their own FHIR requirements. Phase 3 of CMS-4208-F2 will eventually require full FHIR compliance for the National Provider Directory. So there is no new FHIR API build required for MPF Phase 2 — but FHIR itself is very much a current and expanding mandate. The risk we’re flagging is scope creep on Phase 2 specifically, not a suggestion that FHIR is optional. 

Building and maintaining that FHIR foundation for CMS-9115 today, state requirements in many markets, and Phase 3 tomorrow is where we focus.  

The Dates That Matter Right Now 

• Now: The CMS testing window is; daily validation has started 
• August 31, 2026: Testing window closes 
• September 1, 2026: Annual attestation due in HPMS 
• October 1, 2026: CMS begins ingesting plan-supplied data into Medicare Plan Finder 
• October 15, 2026: Annual Enrollment Period begins 

If your network data isn’t validated and flowing into Plan Finder by October 15, beneficiaries comparing plans won’t see your provider network. During AEP, that’s not a recoverable situation. 

What We’re Seeing and What We’re Doing About It 

This isn’t a new space for us. Since the 2020 CMS interoperability mandates under CMS-9115, we’ve been building and maintaining FHIR-compliant provider directory APIs for health plan Kyruus Connect customers. That foundation is already in place for many of our plans, which means for Phase 2, the path forward is largely about configuration, validation, and coordination rather than building something from scratch. 

For our Medicare Advantage customers, here’s what we’re doing: 

• Phase 2 FHIR-based JSON Creation: We’re generating the FHIR-based JSON outputs for CMS to crawl—from your existing provider directory data in Kyruus Connect. For most plans, the data infrastructure is already there. 
• CMS testing support: We’re working with customers through the June–August validation window to address data quality findings before the attestation deadline. Our team is proactively coordinating with data and technical contacts at each plan. 
• Preparedness for Phase 3 and upcoming FHIR mandates: For plans that want to get ahead of future requirements, we already support outbound FHIR provider directory APIs under CMS-9115. Enabling that endpoint is a configuration exercise, not a new project. 

We’re also watching what’s downstream. The REAL Health Providers Act, signed as part of the Consolidated Appropriations Act, 2026, adds new accuracy requirements on top of CMS-4208-F2: provider records must be verified every 90 days, removed from directories within 5 business days of a network departure, and beginning in 2029, plans will have public accuracy scores. Provider data liquidity, clean, current, connected data flowing between plans, providers, and regulators is where this is all heading, and we are committed to helping our customers stay on track.   

What This Means for You 

If you’re a health plan Kyruus Connect customer, you’re not navigating this alone. If you want to get a head start or have questions about where you stand, reach out to your account manager. We’ll take a look at your current setup, walk through what’s needed for the May testing window, and make sure you’re in good shape before October. 

Questions about your CMS-4208-F2 readiness? Contact your Kyruus Connect account manager to get started.