SB 402 (CA) imposes detailed obligations on health care service plans to publish and maintain accurate, searchable provider directories for each network and product. It prescribes online and printed access rules, comprehensive data elements to display, timelines for provider notification and plan verification, and phased accuracy benchmarks that escalate to 95% by July 1, 2029.
The statute also gives the Department authority to develop uniform directory standards, establish or designate a central utility for directory data, and enforce compliance through administrative penalties and limited payment-delay remedies against nonresponsive providers. Crucially for patients, the law requires plans to arrange and pay for care when inaccurate directory information causes an enrollee to receive out-of-network services and to hold the enrollee harmless for charges beyond in-network cost sharing.
At a Glance
What It Does
SB 402 requires health plans to publish public, searchable online directories and provide printed copies on request; to update online listings at least weekly and printed directories at least quarterly; and to meet phased accuracy benchmarks (60% in 2026 up to 95% in 2029). The department can standardize formats and require a central utility to collect provider data.
Who It Affects
The law directly affects licensed health care service plans operating in California (including specialized and vision/dental plans), provider groups and individual providers required to verify directory data, central utility vendors if designated, and the Department of Managed Health Care as regulator.
Why It Matters
Providers and plans face new operational workflows, verification obligations, and potential financial consequences for noncompliance; consumers gain clearer search tools and stronger financial protections when directories are wrong—shifting accountability onto plans and their data processes.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB 402 sets concrete rules for what a health plan’s provider directory must be and how it must behave. Plans must publish a directory for each product and network using consistent naming or classification so users can tell which providers participate in which product.
Online directories must be publicly accessible without requiring membership or identifiers, linked clearly from the plan’s website, and searchable by an extended list of fields (name, address, NPI, license number, admitting hospitals, product, tier, languages, group, facility, and more). Printed copies must be mailed within five business days of request and carry the date of last update.
Plans must keep directories current on a defined cadence: online updates at least weekly when changes are confirmed and printed directories updated at least quarterly. When a provider stops accepting new patients, leaves a plan, moves, or otherwise changes listed data, plans must update the listing upon confirmation and remove providers who are no longer contracted.
Plans must notify providers regularly—at least every six months for unaffiliated individual providers and annually for most others—and require affirmative confirmation of directory data. If providers fail to respond, plans follow a verification protocol that can lead to temporary notices on listings and eventual removal after a 10-business-day advance notice.The statute introduces measurable accuracy targets for plan directories: plans must hit 60% accuracy on July 1, 2026, rising to 80% (2027), 90% (2028), and 95% (2029).
Accuracy is measured at the provider-listing level: any single error affecting access renders that listing inaccurate. The department may create uniform standards, a standardized request format for providers, and may designate a central utility to collect and distribute provider data; plans retain ultimate responsibility for accuracy even if they rely on a utility.Enforcement combines reporting, administrative penalties, and targeted operational remedies.
The department will use accuracy verification reports (which plans must file and post publicly) to assess compliance and may adjust penalties periodically by linking them to premium changes. Plans can delay certain payments to providers who repeatedly fail to verify their data, subject to notification and caps (for example, up to 50% of the next capitation payment for up to one month or claims payment delays of up to one month), but plans must repay delayed amounts quickly once the provider supplies the required information.
For consumers harmed by inaccurate listings, the law requires the plan to arrange and pay for covered services as if they were in-network, reimburse providers at out-of-network rates, and protect the enrollee from charges beyond in-network cost sharing.
The Five Things You Need to Know
Plans must update online directories at least weekly when changes are confirmed, provide printed directories within five business days of request, and update printed directories at least quarterly.
Accuracy benchmarks phase in: 60% by July 1, 2026; 80% by July 1, 2027; 90% by July 1, 2028; and 95% by July 1, 2029; a single access-impacting error makes a listing inaccurate.
The Department may, by January 1, 2026, require or designate a central utility for provider data and develop uniform naming and verification standards; such standards are temporarily exempt from the Administrative Procedure Act through specified dates.
A plan may delay up to 50% of a next capitation payment or delay claims payments for up to one calendar month for providers who fail to respond to verification attempts after required notices, but must reimburse delayed sums promptly when information is provided.
If an enrollee reasonably relied on inaccurate directory information, the plan must arrange coverage, hold the enrollee harmless for charges beyond in-network cost sharing, and reimburse the provider the out-of-network amount—after the department confirms the services were covered under the enrollee’s contract.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Publication, network-specific directories, and public online access
These clauses require plans to publish a separate directory for each network/product, use consistent naming or classification so stakeholders can match providers to products, and make online directories publicly accessible without login or proof of coverage. Practically, plans must design website navigation and backend data structures that expose product-level participation and support broad searches by fields such as NPI and admitting hospital—work that will require IT changes for many issuers.
Printed directories, update cadence, and removal rules
Plans must mail printed directories within five business days of request and update them at least quarterly. For online directories, the law mandates weekly updates when changes are confirmed. The statute sets clear triggers for deletion—retirement, contract termination, or a provider leaving a group—and spells out steps the plan must take to verify and then remove a listing, including a 10-business-day advance notice before removal if verification efforts fail.
Required directory data elements for full-service and specialized plans
Full-service and behavioral health plans must include extensive provider details: names, locations, contact info, NPI, California license, specialty and board certification, affiliated group, admitting privileges, languages, whether accepting new patients, and tiering information. Vision/dental/specialty plans have a similar but tailored list. These precise data elements raise expectations for data collection and recordkeeping and expand what plans must verify from providers.
Provider notification, verification process, and plan procedures
Contracts must require providers to notify plans within five business days of changes to accepting new patients status. Plans must contact providers at least semiannually or annually depending on classification, require affirmative responses, provide an online interface for verification, and document all verification attempts. The plan must file its update policies with the department annually. This creates a repeatable, auditable workflow linking contracts, provider portals, and compliance reporting.
Accuracy measurement, reporting, and benchmarks
Accuracy is defined at the listing level—one error that impacts access renders the listing inaccurate. Plans must annually verify directories, submit and publicly post accuracy verification reports, and meet phased benchmarks from 60% to 95% between 2026 and 2029. The department will define procedures for verification and can require use of a central utility’s data while still holding plans accountable for final accuracy.
Remedies: payment delays, contract termination, and enrollee protections
Plans may delay certain payments to nonresponsive providers after following verification and notice steps—capped quantitatively and limited to one month—while retaining the authority to terminate contracts for repeated failures. Separately, when an enrollee reasonably relied on erroneous directory data, the plan must arrange coverage, reimburse providers, and limit enrollee charges to in-network cost sharing; plans must also respond quickly (1–2 business days) to enrollee verification requests and retain records for two years.
Department role, central utility authority, network reporting, and Medi-Cal scope
The department may set uniform standards and a methodology for accuracy, develop standardized formats for provider submissions, and designate a central utility—subject to limited APA exemptions for deadlines specified in the statute. The department defines “actively contracting” for network use and requires plan amendments if networks change materially. Provisions apply to Medi-Cal managed care plans only to the extent consistent with federal law, and some accuracy-benchmark paragraphs do not apply to certain Medi-Cal plans.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Enrollees seeking care (including behavioral health and autism services): They gain public, searchable directories, faster responses when they confirm network status, and financial protection if they are misled by incorrect listings.
- Consumer advocates and state regulators: The law creates measurable accuracy reporting, public posting of verification reports, and enforcement tools that enable oversight and targeted interventions.
- Providers who keep accurate data: Practices that maintain up-to-date listings avoid payments delays, removals, and consumer complaints, and may attract more appropriate referrals from plans and patients.
Who Bears the Cost
- Health care service plans (insurers and HMOs): They must build or upgrade web search interfaces, invest in verification workflows, run regular provider outreach, integrate central utility feeds if required, file accuracy reports, and potentially face penalties—raising administrative costs.
- Provider groups and individual providers: Practices must respond to frequent verification requests, update information within 30 days of changes, and face potential payment delays or contract termination if they fail to comply, which can strain small or solo practices.
- State Department of Managed Health Care: The department must develop standards, oversee central-utility designation, review plan policies and accuracy reports, and enforce penalties—requiring staff time and technical capacity.
Key Issues
The Core Tension
The bill balances consumer protection through near-real-time, highly accurate public directories against the administrative and financial burden of maintaining that level of accuracy at scale; achieving the consumer benefit depends on costly data systems, provider cooperation, and potentially a central utility whose quality must be governed—trade-offs that can shrink provider networks or shift costs to small practices if not managed carefully.
SB 402 creates a robust accountability regime but also invites practical implementation questions. Measuring accuracy at the listing level (where a single access-impacting error renders the listing inaccurate) is consumer-protective but makes hitting high percentage targets operationally challenging—especially for large plans with thousands of clinicians and for specialties where clinician availability fluctuates.
Plans will need automated provider portals, reliable reconciliation processes with credentialing and claims systems, and contractual leverage with provider groups, any of which carries cost and time.
The statute’s central-utility option aims to reduce duplication, but it transfers a data-quality dependency to a third party. Contracts with a central utility must forbid passing along incomplete data, and the department can de-designate a utility that performs poorly, yet the law still holds plans responsible for final directory accuracy.
That dual structure raises governance questions about liability, timeliness of updates, and who pays for utility operations. The payment-delay remedy gives plans leverage to compel provider responsiveness but risks cash-flow pain for small practices and could accelerate network narrowing where providers choose contract termination over administrative burdens.
Finally, several provisions are qualified by consistency with federal law for Medi-Cal plans, leaving open how the rules will align with federal managed-care requirements and whether practical carve-outs will emerge.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.